CVE-2017-0902
HighSummary
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
Risk Assessment
An attacker could install malicious software on users' systems, leading to potential security breaches and data loss.
Recommendation
It is recommended to update RubyGems to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in RubyGems
See all- CVE-2017-0901High
RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
- CVE-2017-0900High
RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that can lead to a denial of service attack against RubyGems clients who have issued a `query` command.
- CVE-2017-0903Critical
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists.
- CVE-2017-0899Critical
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification could execute terminal escape sequences.
- CVE-2026-82455Low risk· EPSS 4%
Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
Original NVD description (English source)
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS