CVE-2017-0903
At a glance Severity Not available EPSS EPSS 15.85 % · percentile 97 (2026-10-27) State PUBLISHED Published 2017-10-11 Updated 2024-09-17 Assigner hackerone NVD status Modified Description RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Scores Version Score Vector Scored by CVSS 3.0 CRITICAL 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 HIGH 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
Advisories
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*+47 more Affected products
References
Sources
