RubyGems Code Injection vulnerability

CRITICAL 9.8CVE-2017-0899 · GHSA-7gcp-2gmq-w3xh · Published 31/08/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
rubygems-update RubyGems	`< 2.6.13`	`2.6.13`
rubygems rubygems	`≤ 2.6.12`	No fix yet

Description

RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

NVD description

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

References

nvd.nist.gov/vuln/detail/CVE-2017-0899 · ADVISORY
rubygems/rubygems commit 1bcbc7f · WEB
rubygems/rubygems commit ef0aa61 · WEB
hackerone.com/reports/226335 · WEB
access.redhat.com/errata/RHSA-2017:3485 · WEB
access.redhat.com/errata/RHSA-2018:0378 · WEB
access.redhat.com/errata/RHSA-2018:0583 · WEB
access.redhat.com/errata/RHSA-2018:0585 · WEB
rubygems/rubygems · PACKAGE
lists.debian.org/debian-lts-announce/2018/07/msg00012.html · WEB
security.gentoo.org/glsa/201710-01 · WEB
web.archive.org/web/20170907215801/http://www.securitytracker.com/id/1039249 · WEB
web.archive.org/web/20170915000000*/http://www.securityfocus.com/bid/100576 · WEB
debian.org/security/2017/dsa-3966 · WEB
blog.rubygems.org/2017/08/27/2.6.13-released.html · WEB
securityfocus.com/bid/100576 · Third Party Advisory
securitytracker.com/id/1039249 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free