CVE-2017-0900
HighSummary
RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that can lead to a denial of service attack against RubyGems clients who have issued a `query` command.
Risk Assessment
Organizations may experience service outages in RubyGems, which can impact development processes and application performance.
Recommendation
It is recommended to upgrade RubyGems to a version newer than 2.6.12 to mitigate the risk associated with this vulnerability.
Other vulnerabilities in RubyGems
See all- CVE-2017-0902High
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
- CVE-2017-0901High
RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
- CVE-2017-0903Critical
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists.
- CVE-2017-0899Critical
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification could execute terminal escape sequences.
- CVE-2026-82455Low risk· EPSS 4%
Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
Original NVD description (English source)
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS