ByteOS Network

CVE Vulnerability Details :

CVE-2017-0899

PUBLISHED

More Info Official Page

Assigner-hackerone

Assigner Org ID-36234546-b8fa-4601-9d6f-f4e334aa8ea1

Published At-31 Aug, 2017 | 20:00

Updated At-17 Sep, 2024 | 02:20

▼CVE Numbering Authority (CNA)

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

Affected Products

Vendor

HackerOne

Product

RubyGems

Versions

Affected

Versions before 2.6.13

Problem Types

Type	CWE ID	Description
CWE	CWE-150	Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

Type: CWE

CWE ID: CWE-150

Description: Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

References

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2018:0585	vendor-advisory x_refsource_REDHAT
https://www.debian.org/security/2017/dsa-3966	vendor-advisory x_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2018:0378	vendor-advisory x_refsource_REDHAT
https://hackerone.com/reports/226335	x_refsource_MISC
http://www.securitytracker.com/id/1039249	vdb-entry x_refsource_SECTRACK
https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1	x_refsource_MISC
https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2017:3485	vendor-advisory x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html	mailing-list x_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:0583	vendor-advisory x_refsource_REDHAT
https://security.gentoo.org/glsa/201710-01	vendor-advisory x_refsource_GENTOO
http://www.securityfocus.com/bid/100576	vdb-entry x_refsource_BID
http://blog.rubygems.org/2017/08/27/2.6.13-released.html	x_refsource_MISC

Hyperlink: https://access.redhat.com/errata/RHSA-2018:0585

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://www.debian.org/security/2017/dsa-3966

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: https://access.redhat.com/errata/RHSA-2018:0378

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://hackerone.com/reports/226335

Resource:

x_refsource_MISC

Hyperlink: http://www.securitytracker.com/id/1039249

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1

Resource:

x_refsource_MISC

Hyperlink: https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491

Resource:

x_refsource_MISC

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3485

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://access.redhat.com/errata/RHSA-2018:0583

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://security.gentoo.org/glsa/201710-01

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: http://www.securityfocus.com/bid/100576

Resource:

vdb-entry

x_refsource_BID

Hyperlink: http://blog.rubygems.org/2017/08/27/2.6.13-released.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2018:0585	vendor-advisory x_refsource_REDHAT x_transferred
https://www.debian.org/security/2017/dsa-3966	vendor-advisory x_refsource_DEBIAN x_transferred
https://access.redhat.com/errata/RHSA-2018:0378	vendor-advisory x_refsource_REDHAT x_transferred
https://hackerone.com/reports/226335	x_refsource_MISC x_transferred
http://www.securitytracker.com/id/1039249	vdb-entry x_refsource_SECTRACK x_transferred
https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1	x_refsource_MISC x_transferred
https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491	x_refsource_MISC x_transferred
https://access.redhat.com/errata/RHSA-2017:3485	vendor-advisory x_refsource_REDHAT x_transferred
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html	mailing-list x_refsource_MLIST x_transferred
https://access.redhat.com/errata/RHSA-2018:0583	vendor-advisory x_refsource_REDHAT x_transferred
https://security.gentoo.org/glsa/201710-01	vendor-advisory x_refsource_GENTOO x_transferred
http://www.securityfocus.com/bid/100576	vdb-entry x_refsource_BID x_transferred
http://blog.rubygems.org/2017/08/27/2.6.13-released.html	x_refsource_MISC x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:0585

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://www.debian.org/security/2017/dsa-3966

Resource:

vendor-advisory

x_refsource_DEBIAN

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:0378

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://hackerone.com/reports/226335

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.securitytracker.com/id/1039249

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2017:3485

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:0583

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://security.gentoo.org/glsa/201710-01

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: http://www.securityfocus.com/bid/100576

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: http://blog.rubygems.org/2017/08/27/2.6.13-released.html

Resource:

x_refsource_MISC

x_transferred

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References