TI-2017-00851 CVE-2017-0903 · GHSA-mqwr-4qf2-2hcv
Deserialization of untrusted data in HackerOne RubyGems
Priority MEDIUM 58
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.
RHSA-2017:3485
rh-ruby24-ruby security, bug fix, and enhancement update
Released 2017-12-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ruby24-ruby-2.4.2-86.el6, rh-ruby24-ruby-devel-2.4.2-86.el6, rh-ruby24-ruby-doc-2.4.2-86.el6 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby24-ruby-2.4.2-86.el7, rh-ruby24-ruby-devel-2.4.2-86.el7, rh-ruby24-ruby-doc-2.4.2-86.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-ruby24-ruby-2.4.2-86.el6, rh-ruby24-ruby-devel-2.4.2-86.el6, rh-ruby24-ruby-doc-2.4.2-86.el6 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-ruby24-ruby-2.4.2-86.el7, rh-ruby24-ruby-devel-2.4.2-86.el7, rh-ruby24-ruby-doc-2.4.2-86.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-ruby24-ruby-2.4.2-86.el7, rh-ruby24-ruby-devel-2.4.2-86.el7, rh-ruby24-ruby-doc-2.4.2-86.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ruby24-ruby-2.4.2-86.el6, rh-ruby24-ruby-devel-2.4.2-86.el6, rh-ruby24-ruby-doc-2.4.2-86.el6 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby24-ruby-2.4.2-86.el7, rh-ruby24-ruby-devel-2.4.2-86.el7, rh-ruby24-ruby-doc-2.4.2-86.el7 +17
Fixes 8 records
TI-2017-00849 CVE-2017-0901 · GHSA-pm9x-4392-2c2p
Path traversal in HackerOne RubyGems
Priority MEDIUM 56
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
TI-2017-07892 CVE-2017-10784 · GHSA-369m-2gv6-mw28
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before…
Priority MEDIUM 55
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute ar…
TI-2017-00847 CVE-2017-0899 · GHSA-7gcp-2gmq-w3xh
Code injection in HackerOne RubyGems
Priority MEDIUM 55
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.
TI-2017-10240 CVE-2017-14064 · GHSA-954h-8gv7-2q75
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary…
Priority MEDIUM 54
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call.
TI-2017-00846 CVE-2017-0898 · GHSA-wvmx-3rv2-5jgf
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which…
Priority MEDIUM 51
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value.
TI-2017-00848 CVE-2017-0900 · GHSA-p7f2-rr42-m9xm
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem…
Priority MEDIUM 44
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.
TI-2017-00850 CVE-2017-0902 · GHSA-73w7-6w9g-gc8w
Origin validation error in HackerOne RubyGems
Priority MEDIUM 43
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.