CVE-2017-0903
A vulnerability was found where the rubygems module was vulnerable to an unsafe YAML deserialization when inspecting a gem. Applications inspecting gem files without installing them can be tricked to execute arbitrary code in the context of the ruby interpreter.
Find out more about CVE-2017-0903 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
This issue did not affect the versions of rubygems as shipped with Red Hat Enterprise Linux 6.
This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVSS v3 metrics
| CVSS3 Base Score | 5.6 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity Impact | Low |
| Availability Impact | Low |
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Software Collections for Red Hat Enterprise Linux 6 (rh-ruby23-ruby) | RHSA-2018:0585 | 2018-03-26 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 (rh-ruby22-ruby) | RHSA-2018:0583 | 2018-03-26 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 (rh-ruby22-ruby) | RHSA-2018:0583 | 2018-03-26 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 (rh-ruby24-ruby) | RHSA-2017:3485 | 2017-12-19 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 (rh-ruby24-ruby) | RHSA-2017:3485 | 2017-12-19 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 (rh-ruby23-ruby) | RHSA-2018:0585 | 2018-03-26 |
| Red Hat Enterprise Linux 7 (ruby) | RHSA-2018:0378 | 2018-02-28 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Subscription Asset Manager 1 | ruby193-rubygems | Not affected |
| Red Hat Satellite 6 | rubygems | Not affected |
| Red Hat Enterprise MRG 2 | rubygems | Not affected |
| Red Hat Enterprise Linux 6 | rubygems | Not affected |