CVE-2017-0903

Critical

Published: 11/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists.

Risk Assessment

An attacker could exploit specially crafted objects to escalate privileges and achieve remote code execution, posing a serious security threat to the system.

Recommendation

It is recommended to update RubyGems to the latest version to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.