GitHub Advisoryadvisory · RubyGems

GHSA-7gcp-2gmq-w3xh RubyGems Code Injection vulnerability

CRITICAL Published 2022-05-13 Modified 2023-03-09 Official page ↗
Aliases
CVE-2017-0899
Ecosystem
RubyGems
Packages
rubygems-update
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-150, CWE-94
Reviewed
2023-03-09

Affected packages

• RubyGems rubygems-update: < 2.6.13 → fixed in 2.6.13

Description

RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

Related

Alias · CVE (1)

  • CVE-2017-0899 RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. vulnerability

Weakness · CWE (2)

  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness
  • CWE-94 Improper Control of Generation of Code weakness

References