CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
rubygemsrubygems
𝑥
≤ 2.6.12
debiandebian_linux
8.0
debiandebian_linux
9.0
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
17.10
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_aus
7.6
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_server_eus
7.6
redhatenterprise_linux_server_tus
7.4
redhatenterprise_linux_server_tus
7.6
redhatenterprise_linux_workstation
7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
rubygems
bookworm
3.3.15-2
fixed
bullseye
3.2.5-2
fixed
sid
3.4.20-1
fixed
trixie
3.4.20-1
fixed
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jruby
artful
ignored
bionic
needed
cosmic
ignored
disco
ignored
eoan
ignored
focal
needed
groovy
ignored
hirsute
ignored
impish
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
trusty
needs-triage
xenial
needed
zesty
ignored
ruby1.9.1
artful
dne
bionic
dne
cosmic
dne
disco
dne
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
zesty
dne
ruby2.0
artful
dne
bionic
dne
cosmic
dne
disco
dne
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
Fixed 2.0.0.484-1ubuntu2.10
released
xenial
dne
zesty
dne
ruby2.3
artful
Fixed 2.3.3-1ubuntu1.3
released
bionic
dne
cosmic
dne
disco
dne
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
Fixed 2.3.1-2~16.04.6
released
zesty
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libruby2_1-2_1
suse enterprise sap 12 SP4
2.1.9-19.3.2
fixed
suse enterprise sap 12 SP5
2.1.9-19.3.2
fixed
suse enterprise server 12 SP2
2.1.9-19.3.2
fixed
suse enterprise server 12 SP3
2.1.9-19.3.2
fixed
suse enterprise server 12 SP4
2.1.9-19.3.2
fixed
suse enterprise server 12 SP5
2.1.9-19.3.2
fixed
yast2-ruby-bindings
suse enterprise server 12 SP2
3.1.53-9.8.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
ruby
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-devel
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-doc
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-irb
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-libs
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-tcltk
RHEL 7
0:2.0.0.648-33.el7_4
fixed
rubygem-bigdecimal
RHEL 7
0:1.2.0-33.el7_4
fixed
rubygem-io-console
RHEL 7
0:0.4.2-33.el7_4
fixed
rubygem-json
RHEL 7
0:1.7.7-33.el7_4
fixed
rubygem-minitest
RHEL 7
0:4.3.2-33.el7_4
fixed
rubygem-psych
RHEL 7
0:2.0.0-33.el7_4
fixed
rubygem-rake
RHEL 7
0:0.9.6-33.el7_4
fixed
rubygem-rdoc
RHEL 7
0:4.0.0-33.el7_4
fixed
rubygems
RHEL 7
0:2.0.14.1-33.el7_4
fixed
rubygems-devel
RHEL 7
0:2.0.14.1-33.el7_4
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ruby22
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-debuginfo
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-devel
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-doc
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-irb
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby22-libs
Amazon Linux 1
0:2.2.8-1.9.amzn1
fixed
ruby23
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-debuginfo
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-devel
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-doc
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-irb
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby23-libs
Amazon Linux 1
0:2.3.5-1.17.amzn1
fixed
ruby24
Amazon Linux 1
0:2.4.2-1.30.4.amzn1
fixed
ruby24-debuginfo
Amazon Linux 1
0:2.4.2-1.30.4.amzn1
fixed
ruby24-devel
Amazon Linux 1
0:2.4.2-1.30.4.amzn1
fixed
ruby24-doc
Amazon Linux 1
0:2.4.2-1.30.4.amzn1
fixed
ruby24-irb
Amazon Linux 1
0:2.4.2-1.30.4.amzn1
fixed
ruby24-libs
Amazon Linux 1
0:2.4.2-1.30.4.amzn1
fixed
rubygem22-bigdecimal
Amazon Linux 1
0:1.2.6-1.9.amzn1
fixed
rubygem22-io-console
Amazon Linux 1
0:0.4.3-1.9.amzn1
fixed
rubygem22-psych
Amazon Linux 1
0:2.0.8.1-1.9.amzn1
fixed
rubygem23-bigdecimal
Amazon Linux 1
0:1.2.8-1.17.amzn1
fixed
rubygem23-did_you_mean
Amazon Linux 1
0:1.0.0-1.17.amzn1
fixed
rubygem23-io-console
Amazon Linux 1
0:0.4.5-1.17.amzn1
fixed
rubygem23-json
Amazon Linux 1
0:1.8.3.1-1.17.amzn1
fixed
rubygem23-psych
Amazon Linux 1
0:2.1.0.1-1.17.amzn1
fixed
rubygem24-bigdecimal
Amazon Linux 1
0:1.3.0-1.30.4.amzn1
fixed
rubygem24-did_you_mean
Amazon Linux 1
0:1.1.0-1.30.4.amzn1
fixed
rubygem24-io-console
Amazon Linux 1
0:0.4.6-1.30.4.amzn1
fixed
rubygem24-json
Amazon Linux 1
0:2.0.4-1.30.4.amzn1
fixed
rubygem24-psych
Amazon Linux 1
0:2.2.2-1.30.4.amzn1
fixed
rubygem24-xmlrpc
Amazon Linux 1
0:0.2.1-1.30.4.amzn1
fixed
rubygems22
Amazon Linux 1
0:2.4.5.2-1.9.amzn1
fixed
rubygems22-devel
Amazon Linux 1
0:2.4.5.2-1.9.amzn1
fixed
rubygems23
Amazon Linux 1
0:2.5.2.1-1.17.amzn1
fixed
rubygems23-devel
Amazon Linux 1
0:2.5.2.1-1.17.amzn1
fixed
rubygems24
Amazon Linux 1
0:2.6.13-1.30.4.amzn1
fixed
rubygems24-devel
Amazon Linux 1
0:2.6.13-1.30.4.amzn1
fixed
Common Weakness Enumeration
References
http://blog.rubygems.org/2017/08/27/2.6.13-released.html
http://www.securityfocus.com/bid/100586
http://www.securitytracker.com/id/1039249
https://access.redhat.com/errata/RHSA-2017:3485
https://access.redhat.com/errata/RHSA-2018:0378
https://access.redhat.com/errata/RHSA-2018:0583
https://access.redhat.com/errata/RHSA-2018:0585
https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32
https://hackerone.com/reports/218088
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://security.gentoo.org/glsa/201710-01
https://usn.ubuntu.com/3553-1/
https://usn.ubuntu.com/3685-1/
https://www.debian.org/security/2017/dsa-3966
http://blog.rubygems.org/2017/08/27/2.6.13-released.html
http://www.securityfocus.com/bid/100586
http://www.securitytracker.com/id/1039249
https://access.redhat.com/errata/RHSA-2017:3485
https://access.redhat.com/errata/RHSA-2018:0378
https://access.redhat.com/errata/RHSA-2018:0583
https://access.redhat.com/errata/RHSA-2018:0585
https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32
https://hackerone.com/reports/218088
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://security.gentoo.org/glsa/201710-01
https://usn.ubuntu.com/3553-1/
https://usn.ubuntu.com/3685-1/
https://www.debian.org/security/2017/dsa-3966