Description

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

References

http://blog.rubygems.org/2017/10/09/2.6.14-released.html

http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html

http://www.securityfocus.com/bid/101275

https://access.redhat.com/errata/RHSA-2017:3485

https://access.redhat.com/errata/RHSA-2018:0378

https://access.redhat.com/errata/RHSA-2018:0583

https://access.redhat.com/errata/RHSA-2018:0585

https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49

https://hackerone.com/reports/274990

https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

https://usn.ubuntu.com/3553-1/

https://usn.ubuntu.com/3685-1/

https://www.debian.org/security/2017/dsa-4031

Details

Risk Information

CVSS v2

CVSS v3