RubyGems Code Injection vulnerability

緊急 9.8CVE-2017-0899 · GHSA-7gcp-2gmq-w3xh · 31/08/2017 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
rubygems-update RubyGems	`< 2.6.13`	`2.6.13`
rubygems rubygems	`≤ 2.6.12`	修正版なし

概要

RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

NVD の説明

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

参考情報

nvd.nist.gov/vuln/detail/CVE-2017-0899 · ADVISORY
rubygems/rubygems commit 1bcbc7f · WEB
rubygems/rubygems commit ef0aa61 · WEB
hackerone.com/reports/226335 · WEB
access.redhat.com/errata/RHSA-2017:3485 · WEB
access.redhat.com/errata/RHSA-2018:0378 · WEB
access.redhat.com/errata/RHSA-2018:0583 · WEB
access.redhat.com/errata/RHSA-2018:0585 · WEB
rubygems/rubygems · PACKAGE
lists.debian.org/debian-lts-announce/2018/07/msg00012.html · WEB
security.gentoo.org/glsa/201710-01 · WEB
web.archive.org/web/20170907215801/http://www.securitytracker.com/id/1039249 · WEB
web.archive.org/web/20170915000000*/http://www.securityfocus.com/bid/100576 · WEB
debian.org/security/2017/dsa-3966 · WEB
blog.rubygems.org/2017/08/27/2.6.13-released.html · WEB
securityfocus.com/bid/100576 · Third Party Advisory
securitytracker.com/id/1039249 · Third Party Advisory

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン