HackerOne RubyGems
At a glance
- Source
- NVD
- EPSS
- EPSS 15.85 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hackerone
- NVD status
- Modified
Description
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Weaknesses (CWE)
- CWE-502 — Deserialization of Untrusted Data
References
- https://usn.ubuntu.com/3685-1/
- https://usn.ubuntu.com/3553-1/
- https://access.redhat.com/errata/RHSA-2018:0585
- https://access.redhat.com/errata/RHSA-2018:0378
- https://hackerone.com/reports/274990
- https://www.debian.org/security/2017/dsa-4031
- https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
- https://access.redhat.com/errata/RHSA-2017:3485
- http://blog.rubygems.org/2017/10/09/2.6.14-released.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://access.redhat.com/errata/RHSA-2018:0583
- http://www.securityfocus.com/bid/101275
- http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-mqwr-4qf2-2hcv — RubyGems vulnerable to Deserialization of Untrusted Data
European references
- ENISA EUVD · EUVD-2022-4613
- GCVE · GCVE-0-2017-0903
CERT-FR advisories
- CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*- +47 more
Affected products
| Product | Versions |
|---|---|
| HackerOne · RubyGems | affected Versions >= 2.0.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |