kritik
CVE-2017-0899
rubygems: Escape sequence in the "summary" field of gemspec
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Ruby Advisory DB. Daha düşük diyenler: Oracle (yüksek), Amazon (orta), Red Hat (düşük), Ubuntu (düşük).
Açıklama
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.6.13 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.4.5.3, >= 2.5.2.1, >= 2.6.13 |
| alpine 3.10 | ruby | 2.4.2-r0 |
| alpine 3.11 | ruby | 2.4.2-r0 |
| alpine 3.12 | ruby | 2.4.2-r0 |
| alpine 3.13 | ruby | 2.4.2-r0 |
| alpine 3.14 | ruby | 2.4.2-r0 |
| alpine 3.15 | ruby | 2.4.2-r0 |
| alpine 3.16 | ruby | 2.4.2-r0 |
| alpine 3.17 | ruby | 2.4.2-r0 |
| alpine 3.18 | ruby | 2.4.2-r0 |
| alpine 3.19 | ruby | 2.4.2-r0 |
41 kaynaktaki 94 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.6.13 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.4.5.3, >= 2.5.2.1, >= 2.6.13 |
| alpine 3.10 | ruby | 2.4.2-r0 |
| alpine 3.11 | ruby | 2.4.2-r0 |
| alpine 3.12 | ruby | 2.4.2-r0 |
| alpine 3.13 | ruby | 2.4.2-r0 |
| alpine 3.14 | ruby | 2.4.2-r0 |
| alpine 3.15 | ruby | 2.4.2-r0 |
| alpine 3.16 | ruby | 2.4.2-r0 |
| alpine 3.17 | ruby | 2.4.2-r0 |
| alpine 3.18 | ruby | 2.4.2-r0 |
| alpine 3.19 | ruby | 2.4.2-r0 |
| alpine 3.20 | ruby | 2.4.2-r0 |
| alpine 3.21 | ruby | 2.4.2-r0 |
| alpine 3.22 | ruby | 2.4.2-r0 |
| alpine 3.23 | ruby | 2.4.2-r0 |
| alpine 3.24 | ruby | 2.4.2-r0 |
| alpine 3.3 | ruby | 2.2.8-r0 |
| alpine 3.4 | ruby | 2.3.5-r0 |
| alpine 3.5 | ruby | 2.3.5-r0 |
| alpine 3.5 | ruby2.2 | 2.2.8-r0 |
| alpine 3.6 | ruby | 2.4.2-r0 |
| alpine 3.6 | ruby2.2 | 2.2.8-r0 |
| alpine 3.7 | ruby | 2.4.2-r0 |
| alpine 3.8 | ruby | 2.4.2-r0 |
| alpine 3.9 | ruby | 2.4.2-r0 |
| alpine edge | ruby | 2.4.2-r0 |
| amazon linux 1 | ruby22 | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.8-1.9.amzn1 |
| amazon linux 1 | ruby23 | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.5-1.17.amzn1 |
| amazon linux 1 | ruby24 | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.2-1.30.4.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.9.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.9.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.9.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.17.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.17.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.17.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.17.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.17.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.0-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.4.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.4.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.9.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.9.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.1-1.17.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.1-1.17.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.13-1.30.4.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.13-1.30.4.amzn1 |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | rubygems | 3.2.0~rc.1-1 |
| debian 13 | rubygems | 3.2.0~rc.1-1 |
| debian 14 | rubygems | 3.2.0~rc.1-1 |
| debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u6 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u1 |
| echo | rubygems | 3.2.0~rc.1-1 |
| Oracle Linux 7 | ruby | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-33.el7_4 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-33.el7_4 |
| Oracle Linux 7 | rubygem-json | 1.7.7-33.el7_4 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-33.el7_4 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-33.el7_4 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-33.el7_4 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-33.el7_4 |
| Oracle Linux 7 | rubygems | 2.0.14.1-33.el7_4 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-33.el7_4 |
| Red Hat | rubygems | düzeltme belirtilmemiş |
| ubuntu 14.04 | ruby1.9.1 | 1.9.3.484-2ubuntu1.5 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.6 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.6 |
| ubuntu 18.04-ESM | jruby | düzeltme belirtilmemiş |
| ubuntu 20.04-ESM | jruby | düzeltme belirtilmemiş |
Referanslar
- http://blog.rubygems.org/2017/08/27/2.6.13-released.html
- http://www.securityfocus.com/bid/100576
- http://www.securitytracker.com/id/1039249
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://access.redhat.com/security/cve/CVE-2017-0899
25 referansın hepsi
- https://blog.rubygems.org/2017/08/27/2.6.13-released.html
- https://github.com/rubygems/rubygems
- https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1
- https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491
- https://hackerone.com/reports/226335
- https://linux.oracle.com/cve/CVE-2017-0899.html
- https://linux.oracle.com/errata/ELSA-2018-0378.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-0899
- https://security.gentoo.org/glsa/201710-01
- https://ubuntu.com/security/notices/USN-3439-1
- https://ubuntu.com/security/notices/USN-3685-1
- https://web.archive.org/web/20170907215801/http://www.securitytracker.com/id/1039249
- https://web.archive.org/web/20170915000000%2A/http://www.securityfocus.com/bid/100576#:~:text=1%20snapshot-,11%3A49%3A33,-Note
- https://www.cve.org/CVERecord?id=CVE-2017-0899
- https://www.debian.org/security/2017/dsa-3966
- https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/