CVE-2017-0903
En bref Sévérité Non disponible EPSS EPSS 15.85 % · centile 97 (2026-10-27) État PUBLISHED Publiée 2017-10-11 Mise à jour 2024-09-17 Attribuée par hackerone Statut NVD Modified Description RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Scores Version Score Vecteur Évalué par CVSS 3.0 CRITICAL 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 HIGH 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Avis
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*+47 autres Produits affectés
Références
Sources
