RubyGems Code Injection vulnerability

NGHIÊM TRỌNG 9.8CVE-2017-0899 · GHSA-7gcp-2gmq-w3xh · Công bố 31/08/2017 · cập nhật 17/06/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
rubygems-update RubyGems	`< 2.6.13`	`2.6.13`
rubygems rubygems	`≤ 2.6.12`	Chưa có bản vá

Mô tả

RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

Mô tả của NVD

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2017-0899 · ADVISORY
rubygems/rubygems commit 1bcbc7f · WEB
rubygems/rubygems commit ef0aa61 · WEB
hackerone.com/reports/226335 · WEB
access.redhat.com/errata/RHSA-2017:3485 · WEB
access.redhat.com/errata/RHSA-2018:0378 · WEB
access.redhat.com/errata/RHSA-2018:0583 · WEB
access.redhat.com/errata/RHSA-2018:0585 · WEB
rubygems/rubygems · PACKAGE
lists.debian.org/debian-lts-announce/2018/07/msg00012.html · WEB
security.gentoo.org/glsa/201710-01 · WEB
web.archive.org/web/20170907215801/http://www.securitytracker.com/id/1039249 · WEB
web.archive.org/web/20170915000000*/http://www.securityfocus.com/bid/100576 · WEB
debian.org/security/2017/dsa-3966 · WEB
blog.rubygems.org/2017/08/27/2.6.13-released.html · WEB
securityfocus.com/bid/100576 · Third Party Advisory
securitytracker.com/id/1039249 · Third Party Advisory

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí