RubyGems vulnerable to Deserialization of Untrusted Data
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. The issue has been patched in 2.6.14.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-0903US | critical9.8 | — | ||
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://blog.rubygems.org/2017/10/09/2.6.14-released.htmlWEB
- http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.htmlWEB
- https://access.redhat.com/errata/RHSA-2017:3485WEB
- https://access.redhat.com/errata/RHSA-2018:0378WEB
- https://access.redhat.com/errata/RHSA-2018:0583WEB
- https://access.redhat.com/errata/RHSA-2018:0585WEB
- https://github.com/rubygems/rubygemsPACKAGE
- https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan