CVE-2017-0903 — RubyGems vulnerable to Deserialization of Untrusted Data

Description

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

Affected products

Vendor	Product	Affected	Fixed
HackerOne	RubyGems	Versions >= 2.0.0	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	rubygems	3.2.0~rc.1-1	—
Debian 13	rubygems	3.2.0~rc.1-1	—
Debian 12	rubygems	3.2.0~rc.1-1	—
Debian 9	ruby2.3	2.3.3-1+deb9u2	DSA-4031-1
Debian 8	ruby2.1	2.1.5-2+deb8u4	DLA-1421-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	jruby	No fix yet	—
Ubuntu 16.04 LTS	ruby2.3	2.3.1-2~16.04.6	USN-3685-1, USN-3553-1
Ubuntu 14.04 LTS	ruby1.9.1	1.9.3.484-2ubuntu1.12	USN-3685-1
Ubuntu 14.04 LTS	ruby2.0	2.0.0.484-1ubuntu2.10	USN-3685-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 14.04 LTS	jruby	No fix yet	—
Ubuntu Pro 14.04 LTS	ruby2.0	2.0.0.484-1ubuntu2.13+esm1	USN-3685-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	ruby +5	2.0.0.648-33.el7_4	RHSA-2018:0378
RHEL 7	rubygem-bigdecimal	1.2.0-33.el7_4	RHSA-2018:0378
RHEL 7	rubygem-io-console	0.4.2-33.el7_4	RHSA-2018:0378
RHEL 7	rubygem-json	1.7.7-33.el7_4	RHSA-2018:0378
RHEL 7	rubygem-minitest	4.3.2-33.el7_4	RHSA-2018:0378
RHEL 7	rubygem-psych	2.0.0-33.el7_4	RHSA-2018:0378
RHEL 7	rubygem-rake	0.9.6-33.el7_4	RHSA-2018:0378
RHEL 7	rubygem-rdoc	4.0.0-33.el7_4	RHSA-2018:0378
RHEL 7	rubygems +1	2.0.14.1-33.el7_4	RHSA-2018:0378
RHEL 3	rh-ruby22-ruby +5	2.2.9-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-bigdecimal	1.2.6-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-io-console	0.4.3-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-json	1.8.1.1-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-minitest	5.4.3-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-power_assert	0.2.2-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-psych	2.0.8.1-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-rake	10.4.2-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-rdoc	4.2.0-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygem-test-unit	3.0.8-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby22-rubygems +1	2.4.5.4-19.el6	RHSA-2018:0583
RHEL 3	rh-ruby23-ruby +5	2.3.6-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-bigdecimal	1.2.8-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-did_you_mean	1.0.0-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-io-console	0.4.5-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-json	1.8.3.1-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-minitest	5.8.5-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-net-telnet	0.1.1-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-power_assert	0.2.6-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-psych	2.1.0.1-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-rake	10.4.2-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-rdoc	4.2.1-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygem-test-unit	3.1.5-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby23-rubygems +1	2.5.2.2-67.el6	RHSA-2018:0585
RHEL 3	rh-ruby24-ruby +4	2.4.2-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-bigdecimal	1.3.0-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-did_you_mean	1.1.0-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-io-console	0.4.6-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-json	2.0.4-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-minitest	5.10.1-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-net-telnet	0.1.1-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-openssl	2.0.5-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-power_assert	0.4.1-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-psych	2.2.2-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-rake	12.0.0-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-rdoc	5.0.0-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-test-unit	3.2.3-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygem-xmlrpc	0.2.1-86.el6	RHSA-2017:3485
RHEL 3	rh-ruby24-rubygems +1	2.6.14-86.el6	RHSA-2017:3485

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12 SP5	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES 12 SP4	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES 12 SP3	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES 12 SP2	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES 12 SP2	yast2-ruby-bindings	3.1.53-9.8.1	SUSE-SU-2020:1570-1

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP5	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES for SAP 12 SP4	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES for SAP 12 SP3	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES for SAP 12 SP2	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SLES for SAP 12 SP2	yast2-ruby-bindings	3.1.53-9.8.1	SUSE-SU-2020:1570-1
SUSE OpenStack Cloud Crowbar 8	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 8	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 7	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SUSE OpenStack Cloud 7	yast2-ruby-bindings	3.1.53-9.8.1	SUSE-SU-2020:1570-1
SUSE HPE Helion OpenStack 8	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1
SUSE Enterprise Storage 5	ruby2.1	2.1.9-19.3.2	SUSE-SU-2020:1570-1

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	ruby +5	2.0.0.648-33.el7_4	ELSA-2018-0378
Oracle Linux 7	rubygem-bigdecimal	1.2.0-33.el7_4	ELSA-2018-0378
Oracle Linux 7	rubygem-io-console	0.4.2-33.el7_4	ELSA-2018-0378
Oracle Linux 7	rubygem-json	1.7.7-33.el7_4	ELSA-2018-0378
Oracle Linux 7	rubygem-minitest	4.3.2-33.el7_4	ELSA-2018-0378
Oracle Linux 7	rubygem-psych	2.0.0-33.el7_4	ELSA-2018-0378
Oracle Linux 7	rubygem-rake	0.9.6-33.el7_4	ELSA-2018-0378
Oracle Linux 7	rubygem-rdoc	4.0.0-33.el7_4	ELSA-2018-0378
Oracle Linux 7	rubygems +1	2.0.14.1-33.el7_4	ELSA-2018-0378

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	rubygems-update	>= 2.0.0, < 2.6.14	2.6.14	GHSA-mqwr-4qf2-2hcv

Advisories 11

RHSA-2018:0585 Red Hat Security Advisory: rh-ruby23-ruby security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2018:0583 Red Hat Security Advisory: rh-ruby22-ruby security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2018:0378 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2017:3485 Red Hat Security Advisory: rh-ruby24-ruby security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
USN-3685-1 ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
USN-3685-2 ruby2.0 regression Ubuntu Security Notices (USN) · Apr 27, 2026
USN-3553-1 ruby2.3 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-4031-1 ruby2.3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1421-1 ruby2.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2020:1570-1 Security update for ruby2.1 SUSE / openSUSE Security Updates · Feb 4, 2026
ELSA-2018-0378 Important: ruby security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 28, 2018

References

USN-3685-1 vendor-advisory
USN-3553-1 vendor-advisory
RHSA-2018:0585 vendor-advisory
RHSA-2018:0378 vendor-advisory
https://hackerone.com/reports/274990
DSA-4031 vendor-advisory
https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49
RHSA-2017:3485 vendor-advisory
http://blog.rubygems.org/2017/10/09/2.6.14-released.html
[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update mailing-list
RHSA-2018:0583 vendor-advisory
101275 vdb-entry
http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html