kritisch
CVE-2017-0903
rubygems: Unsafe object deserialization through YAML formatted gem specifications
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Ruby Advisory DB. Niedriger laut Oracle (hoch), Red Hat (mittel), Amazon (mittel), Ubuntu (mittel).
Beschreibung
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.6.14 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.6.14 |
| amazon linux 1 | ruby22, ruby22-debuginfo, ruby22-devel und 35 weitere | 2.2.9-1.10.amzn1 und 19 weitere |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | rubygems | 3.2.0~rc.1-1 |
| debian 13 | rubygems | 3.2.0~rc.1-1 |
| debian 14 | rubygems | 3.2.0~rc.1-1 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u2 |
| echo | rubygems | 3.2.0~rc.1-1 |
| Oracle Linux 7 | ruby, ruby-devel, ruby-doc und 12 weitere | 2.0.0.648-33.el7_4 und 8 weitere |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.10 |
Alle 66 Einträge aus 15 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.6.14 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.6.14 |
| amazon linux 1 | ruby22 | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby23 | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby24 | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.10.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.10.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.10.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.18.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.18.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.18.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.18.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.18.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.0-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.5.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.10.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.10.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.2-1.18.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.2-1.18.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.14-1.30.5.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.14-1.30.5.amzn1 |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | rubygems | 3.2.0~rc.1-1 |
| debian 13 | rubygems | 3.2.0~rc.1-1 |
| debian 14 | rubygems | 3.2.0~rc.1-1 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u2 |
| echo | rubygems | 3.2.0~rc.1-1 |
| Oracle Linux 7 | ruby | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-33.el7_4 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-33.el7_4 |
| Oracle Linux 7 | rubygem-json | 1.7.7-33.el7_4 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-33.el7_4 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-33.el7_4 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-33.el7_4 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-33.el7_4 |
| Oracle Linux 7 | rubygems | 2.0.14.1-33.el7_4 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-33.el7_4 |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.10 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.6 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.6 |
| ubuntu 17.10 | ruby2.3 | 2.3.3-1ubuntu1.3 |
Referenzen
- http://blog.rubygems.org/2017/10/09/2.6.14-released.html
- http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
- http://www.securityfocus.com/bid/101275
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://access.redhat.com/security/cve/CVE-2017-0903
Alle 26 Referenzen
- https://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
- https://github.com/rubygems/rubygems
- https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
- https://hackerone.com/reports/274990
- https://linux.oracle.com/cve/CVE-2017-0903.html
- https://linux.oracle.com/errata/ELSA-2018-0378.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-0903
- https://ubuntu.com/security/notices/USN-3553-1
- https://ubuntu.com/security/notices/USN-3685-1
- https://ubuntu.com/security/notices/USN-3685-2
- https://usn.ubuntu.com/3553-1
- https://usn.ubuntu.com/3553-1/
- https://usn.ubuntu.com/3685-1
- https://usn.ubuntu.com/3685-1/
- https://web.archive.org/web/20200227143351/http://www.securityfocus.com/bid/101275
- https://www.cve.org/CVERecord?id=CVE-2017-0903
- https://www.debian.org/security/2017/dsa-4031