Skip to content
OpenAdvisories
Critical DSA-4031-1 4 CVEs

ruby2.3 - security update

Published Nov 11, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 ruby2.3 2.3.3-1+deb9u2

Vulnerabilities 4

  • Critical 9.8
    CVE-2017-0903 EPSS 16%

    RubyGems vulnerable to Deserialization of Untrusted Data

    RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remo…

    HackerOne RubyGems ruby2.3 jruby Debian Ubuntu RubyGems
  • High 8.8
    CVE-2017-10784 EPSS 16%

    WEBrick RCE Vulnerability

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user nam…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-14033

    Ruby OpenSSL DoS Vulnerability

    The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.

    ruby2.3 ruby ruby1.9.1 ruby2.2 Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2017-0898

    Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) …

    HackerOne Ruby ruby2.3 ruby Ubuntu Alpine