CoreCVE
Back

CRITICAL

rubygems: Unsafe object deserialization through YAML formatted gem specifications

Published Oct 11, 2017

Description

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

Affected products

Remediation

Red Hat statement

This issue did not affect the versions of rubygems as shipped with Red Hat Enterprise Linux 6. This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Metrics

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-502

Deserialization of Untrusted Data

References (19)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner hackerone
Published Oct 11, 2017
Updated Sep 17, 2024
Reserved Nov 30, 2016
Link CVE-2017-0903
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-0903
Red Hat
Severity Moderate
Public date Oct 10, 2017
Links CVE-2017-0903 - Bugzilla
GHSA-MQWR-4QF2-2HCV