kritik
CVE-2017-0903
rubygems: Unsafe object deserialization through YAML formatted gem specifications
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Ruby Advisory DB. Daha düşük diyenler: Oracle (yüksek), Red Hat (orta), Amazon (orta), Ubuntu (orta).
Açıklama
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.6.14 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.6.14 |
| amazon linux 1 | ruby22, ruby22-debuginfo, ruby22-devel ve 35 tane daha | 2.2.9-1.10.amzn1 ve 19 tane daha |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | rubygems | 3.2.0~rc.1-1 |
| debian 13 | rubygems | 3.2.0~rc.1-1 |
| debian 14 | rubygems | 3.2.0~rc.1-1 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u2 |
| echo | rubygems | 3.2.0~rc.1-1 |
| Oracle Linux 7 | ruby, ruby-devel, ruby-doc ve 12 tane daha | 2.0.0.648-33.el7_4 ve 8 tane daha |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.10 |
15 kaynaktaki 66 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | rubygems-update | 2.6.14 |
| rubygems::Ruby Advisory Database | rubygems-update | >= 2.6.14 |
| amazon linux 1 | ruby22 | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.9-1.10.amzn1 |
| amazon linux 1 | ruby23 | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.6-1.18.amzn1 |
| amazon linux 1 | ruby24 | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.3-1.30.5.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.10.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.10.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.10.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.18.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.18.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.18.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.18.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.18.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.0-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.5.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.5.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.10.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.10.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.2-1.18.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.2-1.18.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.14-1.30.5.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.14-1.30.5.amzn1 |
| debian 11 | rubygems | 3.2.0~rc.1-1 |
| debian 12 | rubygems | 3.2.0~rc.1-1 |
| debian 13 | rubygems | 3.2.0~rc.1-1 |
| debian 14 | rubygems | 3.2.0~rc.1-1 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u2 |
| echo | rubygems | 3.2.0~rc.1-1 |
| Oracle Linux 7 | ruby | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-33.el7_4 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-33.el7_4 |
| Oracle Linux 7 | rubygem-json | 1.7.7-33.el7_4 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-33.el7_4 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-33.el7_4 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-33.el7_4 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-33.el7_4 |
| Oracle Linux 7 | rubygems | 2.0.14.1-33.el7_4 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-33.el7_4 |
| ubuntu 14.04 | ruby2.0 | 2.0.0.484-1ubuntu2.10 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.6 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.6 |
| ubuntu 17.10 | ruby2.3 | 2.3.3-1ubuntu1.3 |
Referanslar
- http://blog.rubygems.org/2017/10/09/2.6.14-released.html
- http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
- http://www.securityfocus.com/bid/101275
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://access.redhat.com/security/cve/CVE-2017-0903
26 referansın hepsi
- https://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
- https://github.com/rubygems/rubygems
- https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
- https://hackerone.com/reports/274990
- https://linux.oracle.com/cve/CVE-2017-0903.html
- https://linux.oracle.com/errata/ELSA-2018-0378.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-0903
- https://ubuntu.com/security/notices/USN-3553-1
- https://ubuntu.com/security/notices/USN-3685-1
- https://ubuntu.com/security/notices/USN-3685-2
- https://usn.ubuntu.com/3553-1
- https://usn.ubuntu.com/3553-1/
- https://usn.ubuntu.com/3685-1
- https://usn.ubuntu.com/3685-1/
- https://web.archive.org/web/20200227143351/http://www.securityfocus.com/bid/101275
- https://www.cve.org/CVERecord?id=CVE-2017-0903
- https://www.debian.org/security/2017/dsa-4031