Skip to content
OpenAdvisories
High DLA-1112-1 2 CVEs

rubygems - security update

Published Sep 26, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 rubygems 1.8.24-1+deb7u1

Vulnerabilities 2

  • High 7.5
    CVE-2017-0900

    RubyGems Improper Input Validation vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.

    ruby2.3 ruby jruby ruby1.9.1 Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-0901 Public exploit EPSS 29%

    RubyGems may allow a maliciously crafted gem to overwrite files

    RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems