CVE-2017-0903

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-0903
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0903.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-0903
Aliases
Downstream
Related
Published
2017-10-11T18:29:00.583Z
Modified
2026-02-12T08:14:57.516071Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

References

Affected packages

Git
github.com/ruby/json

Affected ranges

Type
GIT
Repo
https://github.com/ruby/json
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
09fabeb03e73ed88dc8ce8f19d76ac59e51dae20
Last affected
1942689b6719af1371f54814999d25307696f71c
Last affected
1c2901905c938ffd19620cc6a06cbb2b34d8ba05
Last affected
2db5894cfa7322b00e24ad21a76ea584b0b22f5a
Last affected
398ec004c666d330d03a0c2f7afa2868c553b1f6
Last affected
44b392b5ede944f73cfbdf65afb9d4dd972e23f5
Last affected
4688035c424a26a8d943c261170988f1b788fa56
Last affected
5d9d8f3799f2f65ebaa7b485fd6078ce5c79818c
Last affected
63bc6ae289a419195ff9bcab0f0fc58e2ace372a
Last affected
6550c427e1e9b1e5e4f1c85346f7e319c647a876
Last affected
885ab0ee5898397ed5440210cca20dc5d3a1f73e
Last affected
92cf5c451a6ec0f3a00e291eb909e57cf38fbea4
Last affected
9dc86f903bb07ca3c4e1f654eefc86e1d0dda400
Last affected
ea58503ee5ea96dece5abe0d582c258a6a11840e
Last affected
f1ca4fed316ad416ae718544623865aca4231a08
Last affected
f679ebd0c69a94e3e70a897ac9a229f5779c2ee1

Affected versions

v1.*
v1.1.8
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.4-java
v1.4.5
v1.4.6
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.2.0
v2.3.0
v2.3.1
v2.4.1
v2.5.0
v2.5.1
v2.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0903.json"
github.com/rubygems/rubygems

Affected ranges

Type
GIT
Repo
https://github.com/rubygems/rubygems
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
009080040279282d7b8ddd09acab41719cb4ba00
Last affected
039269657cd5d6fd6dfaeaa108502c7fbd262d6f
Last affected
082a84a037a04471b831e8d8c8ba5d889227bb94
Last affected
0987ef8f9da5571cc6c49ccead87c661bbba79eb
Last affected
09985b5e4925e12b1378609b4d55c6d194177266
Last affected
0c4783ca90aff35206ff8d04f64d3016f5c1fe58
Last affected
0c8612453cd3a442b13c27805f21604b6ac04f7a
Last affected
0de4e88a19cda7d13116e0d6204ab714a7f63acc
Last affected
182223ed08c2d39892989aecacef5de43c89deba
Last affected
184c0513a74524f872f038c00f4e313c6198def9
Last affected
19527090d4b02403c00a616b64ea715e0ae10988
Last affected
1def9ba6f6b462a3225eb517793e7a4dfbae4335
Last affected
21e409decfc3d4a1629913fa579528094d465d95
Last affected
2ee5bf9fd3bd7649d3e244bc40107ff32070ef47
Last affected
35021ab7e10662351c2de954bc97ff724dcff317
Last affected
3762ffc0bc1e767a6705750f791ee211af831b13
Last affected
384a8802a89edae38a39d4037bb5d37508b3d32f
Last affected
3e243d1ebcd19c1a07edefb42d322ef8710eed60
Last affected
4bfc34cb00f3be715d811bf9106e01a4893fbf92
Last affected
4fdeaa3e548a37d6e3bc3b6bc0fd27714497e2c7
Last affected
516b30370dfaf4508318ca44fe7a8f8faf473eeb
Last affected
59c38c6f0548c2a5d7a013f82ae88b2235ed3c06
Last affected
5d7add54e042de7c846ae783786b32c0a456563d
Last affected
5e58957f6044e9becf7ae072a7f890034ba991df
Last affected
60f35bd1d2359fc30301d2d4cd72bc6833e8d12a
Last affected
63951263617d621ef368a11b1db61b6ed4dea1c7
Last affected
656f5d94dc888d78d0d00f3598a4fa37391aac80
Last affected
6e77ace5dad07d86a38ac271e6a62658ca751105
Last affected
705c8e34a93d24f91ec36fe0e4727471d82ea05a
Last affected
744e413f556ead46aabc659408a99a4c318b6549
Last affected
77ede3cf52c15faf08509a518c6f7dee72793f1c
Last affected
8241846143b57f72c75ecc50d113dd41c8c6a226
Last affected
83101206f2709f12c6b9842abb14dcf94b92676d
Last affected
83c6fa8cad15d91fa9665a40d16dede27b64328b
Last affected
8776f0aa03cd1088397ad98e4c74d7dbb5221457
Last affected
87e05e13bcef810e2bafef7951d577b539ce2a02
Last affected
8993b5f4b5da7305148ca123a96ff941e08f932f
Last affected
954d7c2cc26c843f2d295df3d371db5d0cb347f7
Last affected
9c1101160d1b7394a4acc96f0e183334d7346dfe
Last affected
9fb8880976f5ab998912898b091d88aa10eb1d4a
Last affected
a333cdba7ab06116895671ced29d4c3c34abde25
Last affected
a726271c78e828976ab60cf89b0a9e7738da711c
Last affected
a72c7bd5280a26dcee5fefcc30a86a784de8223b
Last affected
a8aa3bac723f045c52471c7b9328310a048561e0
Last affected
abb9334ed649b34b5450e79dcf2695dcc60f0de7
Last affected
abf89e04954b8a2ddfb6948d0860111990a6efa2
Last affected
adfcf40502716080bd9cdfdd2e43bd4296872784
Last affected
af4ffa745915b35cc8a56b8eb5504a1d2c3cbe27
Last affected
b01eb35e046bcd9f65a8df84594afd3be50adafa
Last affected
b6f3b5fac7ec01e5dcc57d6768a7e9b456feaea8
Last affected
bbe01e339da3e42313091effc0afb21b9a81917e
Last affected
bc4078afc8c373b93c45953c4158daf10d77107d
Last affected
bd4e3ac9a8b4d9d65028040a51f0cf72286f5c82
Last affected
be510dd4097e65c6a256a6e173d6b724a3a96472
Last affected
be819945ba1c788a5b589a9d5daa86e9dcaaba3f
Last affected
c97e75c4bedaf96376a95fe71fb3ac44ed40c18b
Last affected
ccb9c3300c063f5b5656669972d24a10ef8afbf5
Last affected
ccfafdc2c52c5c605ff69ed3a772d83eb19ef55a
Last affected
d32a94848f50d6be448d862e43f074b820a1d3b6
Last affected
daf17d7f33977c4399229685ebf232703592c90c
Last affected
db7a53fbcb0b5994d22f31d952b7ff4e08df7acc
Last affected
dd7ca9b2c321f79dee041e85db07f9b0ac7f4e67
Last affected
ea1c2967b9b75128bcdb9a4fe6ba2c9e7f19c9c4
Last affected
ea4460aba0d3ab943d2cdf6203f9cf57240419ca
Last affected
eb4881926cbc72044dbba06f062202e7373330c1
Last affected
eede098838b14985191c152f7ba46f9e82b0fd14
Last affected
f67a0e929e0a8a625ddb7f598caa04a2bd6dcf02
Last affected
f754a1a5ed187f410538c103351c9ca0a7d3469b
Last affected
f8a132f6f4de8fb2d495dadab750cfafc427d86e

Affected versions

v1.*
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.2
v2.*
v2.0.0
v2.0.0.preview2
v2.0.0.preview2.1
v2.0.0.preview2.2
v2.0.0.rc.1
v2.0.0.rc.2
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.1.0.rc.1
v2.1.0.rc.2
v2.1.1
v2.1.2
v2.1.3
v2.2.0.preview.1
v2.2.0.rc.1
v2.2.1
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.10
v2.6.11
v2.6.12
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0903.json"
github.com/wordpress/wordpress

Affected ranges

Type
GIT
Repo
https://github.com/wordpress/wordpress
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0608ca12bcf22e2b4d17ff069d332d7c0b55936f
Last affected
15ce5cece78e06235648b3cd4d886dce63fac0dc
Last affected
30049fe7914ce81daa03988e67ff54e25990ba92
Last affected
31cbc32eecd06ac70ffd7f4f8f8f2cd8e3d96877
Last affected
4aa6902a9c198af1d1466a30d2d31f6f607ce975
Last affected
50dc218ed13995dcb4573e856df9ac35aaeddaef
Last affected
53f04c334b3b3d61c6621113bbd59046f4312f93
Last affected
75044e4670f011cd2b01aabe29317bb3edf44bee
Last affected
7ce71f800199ad517d5aba9e5a8c1fb77d79ba6a
Last affected
9a7ca67a8747610288f71cdd57a4dbde1e5ad2fd
Last affected
9b6dd3868d04d9e91f174eaa6a9ca1aa53651217
Last affected
a1e896672967a57395192fed8f0ec801e7993e55
Last affected
a54035abd8db31f62b4c421081d371478fca38f7
Last affected
b31237de2e1126ea1982485f57e9c73d81771220
Last affected
badb4ab84299f244f8c08b42d057ba2abf67add0
Last affected
c62aa710091f110696ce205a5cb654fe12792181
Last affected
d27910b029e458f748e9633f4b6e823145eeebff
Last affected
e1172126a13a79d6ac567a511beb06a4ea50cf17
Last affected
e146416b15db310eae0c7e6ccbf6e53e9b84824c
Last affected
e4bd28c86f6f606bed2e8f85ea6f1834f3d63974
Last affected
ee9cfcb2ab5a6822c7b4a636352f74c68bc942d0
Last affected
f724c42db6ba6433092ababc136035c4d1cc36fe

Affected versions

2.*
2.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0903.json"