VIR Vulnerability Intelligence Relay

CVE-2017-0903

critical
Published 2017-10-09 · Modified 2024-02-22
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
7.5
VIR risk
9.8

Description

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-0903

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-0903.html

vendor Authored 2026-05-27

Vendor advisory: support@hackerone.com — https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49

vendor Authored 2026-05-27

Vendor advisory: support@hackerone.com — http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html

vendor Authored 2026-05-27

Vendor advisory: support@hackerone.com — http://blog.rubygems.org/2017/10/09/2.6.14-released.html

OS impact
OSVersionStatusFixed in
suse slesaffected
ubuntu ubuntu14.04affected
ubuntu ubuntu16.04affected
ubuntu ubuntu17.10affected
debian debian8.0affected
debian debian9.0affected
redhat rhel7.0affected
debian debianbookwormfixed3.2.0~rc.1-1
debian debianbullseyefixed3.2.0~rc.1-1
debian debianforkyfixed3.2.0~rc.1-1
debian debiansidfixed3.2.0~rc.1-1
debian debiantrixiefixed3.2.0~rc.1-1

Package impact
EcosystemPackageVulnerableFixed
ruby RubyGemsrubygems-update!< 2.0.0||<>= 2.6.14>= 2.6.14
ruby RubyGemsrubygems-update>=2.0.0,<2.6.142.6.14

Application impact
VendorProductVersionsFixed
rubygemsrubygems2.0.0
rubygemsrubygems2.0.1
rubygemsrubygems2.0.2
rubygemsrubygems2.0.3
rubygemsrubygems2.0.4
rubygemsrubygems2.0.5
rubygemsrubygems2.0.6
rubygemsrubygems2.0.7
rubygemsrubygems2.0.8
rubygemsrubygems2.0.9
rubygemsrubygems2.0.10
rubygemsrubygems2.0.11
rubygemsrubygems2.0.12
rubygemsrubygems2.0.13
rubygemsrubygems2.0.14
rubygemsrubygems2.0.15
rubygemsrubygems2.0.16
rubygemsrubygems2.0.17
rubygemsrubygems2.1.0
rubygemsrubygems2.1.0.rc.1
rubygemsrubygems2.1.0.rc.2
rubygemsrubygems2.1.1
rubygemsrubygems2.1.2
rubygemsrubygems2.1.3
rubygemsrubygems2.1.4
rubygemsrubygems2.1.5
rubygemsrubygems2.1.6
rubygemsrubygems2.1.7
rubygemsrubygems2.1.8
rubygemsrubygems2.1.9
rubygemsrubygems2.1.10
rubygemsrubygems2.1.11
rubygemsrubygems2.2.0
rubygemsrubygems2.2.0.preiew.1
rubygemsrubygems2.2.0.rc.1
rubygemsrubygems2.2.1
rubygemsrubygems2.2.2
rubygemsrubygems2.2.3
rubygemsrubygems2.2.4
rubygemsrubygems2.2.5
rubygemsrubygems2.3.0
rubygemsrubygems2.4.0
rubygemsrubygems2.4.1
rubygemsrubygems2.4.2
rubygemsrubygems2.4.3
rubygemsrubygems2.4.4
rubygemsrubygems2.4.5
rubygemsrubygems2.4.6
rubygemsrubygems2.4.7
rubygemsrubygems2.4.8
rubygemsrubygems2.5.0
rubygemsrubygems2.5.1
rubygemsrubygems2.5.2
rubygemsrubygems2.6.0
rubygemsrubygems2.6.1
rubygemsrubygems2.6.2
rubygemsrubygems2.6.3
rubygemsrubygems2.6.4
rubygemsrubygems2.6.5
rubygemsrubygems2.6.6
rubygemsrubygems2.6.7
rubygemsrubygems2.6.8
rubygemsrubygems2.6.9
rubygemsrubygems2.6.10
rubygemsrubygems2.6.11
rubygemsrubygems2.6.12
rubygemsrubygems2.6.13

References

CWEs

CWE-502

Verify integrity in audit chain (admin only). AS-IS.