CVE-2017-0903

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.2.5:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.4.8:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.5.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.5.2:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.3:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.4:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.5:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.6:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.7:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.8:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.9:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.10:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.11:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.12:*:*:*:*:*:*:*
cpe:2.3:a:rubygems:rubygems:2.6.13:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-10-11 18:29

Updated : 2024-02-04 19:29


NVD link : CVE-2017-0903

Mitre link : CVE-2017-0903

CVE.ORG link : CVE-2017-0903


JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • enterprise_linux_server_tus
  • enterprise_linux_server_aus
  • enterprise_linux_workstation
  • enterprise_linux_server_eus
  • enterprise_linux_server
  • enterprise_linux_desktop

canonical

  • ubuntu_linux

rubygems

  • rubygems
CWE
CWE-502

Deserialization of Untrusted Data