Skip to content
OpenAdvisories
Critical USN-3685-1 9 CVEs

ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities

Published Jun 13, 2018 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Some of these CVE were already addressed in previous
USN: 3439-1, 3553-1, 3528-1. Here we address for
the remain releases.

It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a buffer overrun. (CVE-2017-0898)

It was discovered that Ruby incorrectly handled certain files.
An attacker could use this to overwrite any file on the filesystem.
(CVE-2017-0901)

It was discovered that Ruby was vulnerable to a DNS hijacking vulnerability.
An attacker could use this to possibly force the RubyGems client to download
and install gems from a server that the attacker controls. (CVE-2017-0902)

It was discovered that Ruby incorrectly handled certain YAML files.
An attacker could use this to possibly execute arbitrary code. (CVE-2017-0903)

It was discovered that Ruby incorrectly handled certain files.
An attacker could use this to expose sensitive information.
(CVE-2017-14064)

It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to execute arbitrary code. (CVE-2017-10784)

It was discovered that Ruby incorrectly handled certain network requests.
An attacker could possibly use this to inject a crafted key into a HTTP
response. (CVE-2017-17742)

It was discovered that Ruby incorrectly handled certain files.
An attacker could possibly use this to execute arbitrary code.
This update is only addressed to ruby2.0. (CVE-2018-1000074)

It was discovered that Ruby incorrectly handled certain network requests.
An attacker could possibly use this to cause a denial of service.
(CVE-2018-8777)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS ruby1.9.1 1.9.3.484-2ubuntu1.12
Ubuntu · 14.04 LTS 14.04:LTS ruby2.0 2.0.0.484-1ubuntu2.10
Ubuntu · 16.04 LTS 16.04:LTS ruby2.3 2.3.1-2~16.04.10

Vulnerabilities 9

  • Critical 9.8
    CVE-2017-0903 EPSS 16%

    RubyGems vulnerable to Deserialization of Untrusted Data

    RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remo…

    HackerOne RubyGems ruby2.3 jruby Debian Ubuntu RubyGems
  • High 8.8
    CVE-2017-10784 EPSS 16%

    WEBrick RCE Vulnerability

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user nam…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine RubyGems
  • High 8.1
    CVE-2017-0902

    RubyGems has Origin Validation Error vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • High 7.8
    CVE-2018-1000074

    RubyGems Deserialization of Untrusted Data vulnerability

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner …

    ruby2.3 jruby ruby2.0 ruby1.9.1 Debian Ubuntu Maven RubyGems
  • High 7.5
    CVE-2017-0901 Public exploit EPSS 29%

    RubyGems may allow a maliciously crafted gem to overwrite files

    RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2017-0898

    Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) …

    HackerOne Ruby ruby2.3 ruby Ubuntu Alpine
  • Unscored —
    CVE-2017-14064

    Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate cal…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine
  • Unscored —
    CVE-2017-17742

    Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Respo…

    ruby2.3 ruby jruby ruby2.0 Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-8777

    In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can …

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2017-0898
  • report
    https://ubuntu.com/security/CVE-2017-0901
  • report
    https://ubuntu.com/security/CVE-2017-0902
  • report
    https://ubuntu.com/security/CVE-2017-0903
  • report
    https://ubuntu.com/security/CVE-2017-10784
  • report
    https://ubuntu.com/security/CVE-2017-14064
  • report
    https://ubuntu.com/security/CVE-2017-17742
  • report
    https://ubuntu.com/security/CVE-2018-8777
  • report
    https://ubuntu.com/security/CVE-2018-1000074