CVE-2017-0900
HighSummary
RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that can lead to a denial of service attack against RubyGems clients who have issued a `query` command.
Risk Assessment
Organizations may experience service outages in RubyGems, which can impact development processes and application performance.
Recommendation
It is recommended to upgrade RubyGems to a version newer than 2.6.12 to mitigate the risk associated with this vulnerability.
Other vulnerabilities in RubyGems
See all- CVE-2026-82455High
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory.
- CVE-2017-0902High
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
- CVE-2017-0901High
RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
- CVE-2017-0903Critical
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists.
- CVE-2017-0899Critical
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification could execute terminal escape sequences.
Original NVD description (English source)
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.