CVE-2017-0903CWE-502

CVE-2017-0903: vulnerability in HackerOne RubyGems

Published · Updated

Follow this CVE+ Monitor RubyGems+ Monitor rubygems

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 16%
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Affected products
HackerOne · RubyGems
Related CVEs — HackerOne RubyGems

In the same product, most dangerous first.

CVE-2017-0901—CVE-2017-0901EPSS 29.4%CVE-2017-0899—CVE-2017-0899EPSS 11.1%CVE-2017-0902—CVE-2017-0902EPSS 4.8%