Evil-DB LogoEvil-DB
← All CVEs

CVE-2017-0903

critical · 9.8

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

9.8
CVSS
15.9%
EPSS (exploit prob.)
97th
EPSS percentile
2017-10-11
Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

VendorProductAffected versions
rubygemsrubygems2.0.0
rubygemsrubygems2.0.0
rubygemsrubygems2.0.0
rubygemsrubygems2.0.0
rubygemsrubygems2.0.0
rubygemsrubygems2.0.0
rubygemsrubygems2.0.1
rubygemsrubygems2.0.2
rubygemsrubygems2.0.3
rubygemsrubygems2.0.4
rubygemsrubygems2.0.5
rubygemsrubygems2.0.6
rubygemsrubygems2.0.7
rubygemsrubygems2.0.8
rubygemsrubygems2.0.9
rubygemsrubygems2.0.10
rubygemsrubygems2.0.11
rubygemsrubygems2.0.12
rubygemsrubygems2.0.13
rubygemsrubygems2.0.14
rubygemsrubygems2.0.15
rubygemsrubygems2.0.16
rubygemsrubygems2.0.17
rubygemsrubygems2.1.0
rubygemsrubygems2.1.0.rc.1
rubygemsrubygems2.1.0.rc.2
rubygemsrubygems2.1.1
rubygemsrubygems2.1.2
rubygemsrubygems2.1.3
rubygemsrubygems2.1.4
rubygemsrubygems2.1.5
rubygemsrubygems2.1.6
rubygemsrubygems2.1.7
rubygemsrubygems2.1.8
rubygemsrubygems2.1.9
rubygemsrubygems2.1.10
rubygemsrubygems2.1.11
rubygemsrubygems2.2.0
rubygemsrubygems2.2.0.preiew.1
rubygemsrubygems2.2.0.rc.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-0903