CVE-2017-0903

CRITICAL

RubyGems <2.6.14 - RCE

Title source: llm

Description

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

References (13)

Scores

CVSS v3 9.8
EPSS 0.0462
EPSS Percentile 89.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-502
Status draft

Affected Products (50)

rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
rubygems/rubygems
... and 35 more

Timeline

Published Oct 11, 2017
Tracked Since Feb 18, 2026