RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade ruby22Upgrade ruby24Upgrade ruby23Upgrade ruby22 | Feb 1, 2018 | Oct 9, 2017 |
| Centos_linux | — | Upgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade ruby-docUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubyUpgrade rubygem-rdocUpgrade ruby-irb | Mar 13, 2018 | Oct 9, 2017 |
| Debian | — | Upgrade rubygems | Dec 5, 2017 | Oct 9, 2017 |
| Freebsd | — | Upgrade ruby24-gemsUpgrade ruby22-gemsUpgrade ruby23-gems | Oct 10, 2017 | Oct 10, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Mar 16, 2018 | Oct 11, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Mar 16, 2018 | Oct 11, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Oct 11, 2017 |
| Oracle_linux | — | Upgrade rubygemsUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-rakeUpgrade ruby-tcltkUpgrade ruby-docUpgrade rubygem-rdocUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-json | Mar 1, 2018 | Oct 10, 2017 |
| Redhat_linux | — | Upgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade rubyUpgrade ruby-docUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-debuginfo | Mar 1, 2018 | Oct 9, 2017 |
| Suse | — | Upgrade ruby2.1-develUpgrade ruby2.1Upgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1Upgrade ruby2.1-stdlib | Jun 10, 2020 | Oct 9, 2017 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade ruby2.0 (Ubuntu Pro)Upgrade ruby2.3Upgrade ruby2.0Upgrade libruby2.0 (Ubuntu Pro)Upgrade ruby1.9.1Upgrade ruby1.9.3Upgrade libruby2.0Upgrade libruby2.3 | Feb 1, 2018 | Oct 9, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub