Hackerone Rubygems vulnerabilities
4 vulnerabilities
Known vulnerabilities in Hackerone Rubygems, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2017-0901alpineruby+16
EPSS score29.44%
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.CVE-2017-0899alpineruby+14EPSS score11.10%
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.CVE-2017-0902alpineruby+15EPSS score4.75%
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.CVE-2017-0903canonicalubuntu_linux+14EPSS score15.85%
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.