CVE-2017-0901
HighSummary
RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
Risk Assessment
This vulnerability could lead to data integrity loss and potential system takeover by an attacker.
Recommendation
It is recommended to upgrade RubyGems to a version newer than 2.6.12 to mitigate the risk associated with this vulnerability.
Other vulnerabilities in RubyGems
See all- CVE-2017-0902High
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
- CVE-2017-0900High
RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that can lead to a denial of service attack against RubyGems clients who have issued a `query` command.
- CVE-2017-0903Critical
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists.
- CVE-2017-0899Critical
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification could execute terminal escape sequences.
- CVE-2026-82455Low risk· EPSS 4%
Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
Original NVD description (English source)
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS