NetSight
IP …
critical9.8

CVE-2017-0903

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.

Impact

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

Affected products

VendorProductAffected versions
RubygemsRubygems
Versions 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 17.10
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.4, 7.6
RedhatEnterprise Linux Server Eus
Versions 7.4, 7.5, 7.6
RedhatEnterprise Linux Server Tus
Versions 7.4, 7.6
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-502

References