blog.rubygems.org
http://blog.rubygems.org/2017/08/27/2.6.13-released.html CVE-2017-0900
HIGH
RubyGems Improper Input Validation vulnerability
Record summary
CVE-2017-0900 has a selected CVSS score of 7.5 (high).
Description
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
rubygems-updateBrowse RubyGems / rubygems-update | GitHub Advisory | Before 2.6.13 · Fixed in 2.6.13 | affected |
References
Showing 12 of 16100579vdb entry
http://www.securityfocus.com/bid/100579 1039249vdb entry
http://www.securitytracker.com/id/1039249 RHSA-2017:3485Vendor advisory
https://access.redhat.com/errata/RHSA-2017:3485 RHSA-2018:0378Vendor advisory
https://access.redhat.com/errata/RHSA-2018:0378 RHSA-2018:0583Vendor advisory
https://access.redhat.com/errata/RHSA-2018:0583 RHSA-2018:0585Vendor advisory
https://access.redhat.com/errata/RHSA-2018:0585 github.com
https://github.com/rubygems/rubygems github.com
https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251 hackerone.com
https://hackerone.com/reports/243003 [debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security updatemailing list
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-0900