critical9.8
CVE-2017-0899
RubyGems Code Injection vulnerability
Impact
RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | rubygems-update | < 2.6.13 | 2.6.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rubygems | Rubygems | through 2.6.12 |
| Debian | Debian Linux | Versions 8.0, 9.0 |
| Redhat | Enterprise Linux Desktop | Version 7.0 |
| Redhat | Enterprise Linux Server | Version 7.0 |
| Redhat | Enterprise Linux Server Aus | Versions 7.4, 7.6 |
| Redhat | Enterprise Linux Server Eus | Versions 7.4, 7.5, 7.6 |
| Redhat | Enterprise Linux Server Tus | Versions 7.4, 7.6 |
| Redhat | Enterprise Linux Workstation | Version 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://blog.rubygems.org/2017/08/27/2.6.13-released.html
- http://www.securityfocus.com/bid/100576
- http://www.securitytracker.com/id/1039249
- https://access.redhat.com/errata/RHSA-2017:3485
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0585
- https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1
- https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491
- https://hackerone.com/reports/226335
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://security.gentoo.org/glsa/201710-01
- https://www.debian.org/security/2017/dsa-3966
- https://github.com/advisories/GHSA-7gcp-2gmq-w3xh
- https://nvd.nist.gov/vuln/detail/CVE-2017-0899
- https://web.archive.org/web/20170907215801/http://www.securitytracker.com/id/1039249
- https://web.archive.org/web/20170915000000*/http://www.securityfocus.com/bid/100576#:~:text=1%20snapshot-,11%3A49%3A33,-Note