CVE-2017-0903 – rubygems-update

Package

Manager: gem
Name: rubygems-update
Vulnerable Version: >=2.0.0 <2.6.14

Severity

Level: Critical

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.04901 pctl0.89185

Details

RubyGems vulnerable to Deserialization of Untrusted Data RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. The issue has been patched in 2.6.14.

Metadata

Created: 2022-05-13T01:38:26Z
Modified: 2023-03-09T00:39:36Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-mqwr-4qf2-2hcv/GHSA-mqwr-4qf2-2hcv.json
CWE IDs: ["CWE-502"]
Alternative ID: GHSA-mqwr-4qf2-2hcv
Finding: F096
Auto approve: 1