CVE-2017-0899

9.8 CRITICAL
Published: August 31, 2017 Modified: May 13, 2026
View on NVD

Description

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://blog.rubygems.org/2017/08/27/2.6.13-released.html
Source: support@hackerone.com
Patch Vendor Advisory
http://www.securityfocus.com/bid/100576
Source: support@hackerone.com
Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039249
Source: support@hackerone.com
Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:3485
Source: support@hackerone.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0378
Source: support@hackerone.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0583
Source: support@hackerone.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0585
Source: support@hackerone.com
Third Party Advisory
https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1
Source: support@hackerone.com
Patch Third Party Advisory
https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491
Source: support@hackerone.com
Patch Third Party Advisory
https://hackerone.com/reports/226335
Source: support@hackerone.com
Exploit Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
Source: support@hackerone.com
Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201710-01
Source: support@hackerone.com
Third Party Advisory
https://www.debian.org/security/2017/dsa-3966
Source: support@hackerone.com
Third Party Advisory
http://blog.rubygems.org/2017/08/27/2.6.13-released.html
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Vendor Advisory
http://www.securityfocus.com/bid/100576
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039249
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:3485
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0378
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0583
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0585
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Third Party Advisory
https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Third Party Advisory
https://hackerone.com/reports/226335
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201710-01
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://www.debian.org/security/2017/dsa-3966
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

26 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.8 / 10.0
EPSS (Exploit Probability)
10.8%
95th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-150 CWE-94

Affected Vendors

rubygems debian redhat

Related CVEs

CVE-2026-48777 N/A
CVE-2026-47750 7.8
CVE-2026-47747 7.8
CVE-2026-46448 5.4
CVE-2026-22313 9.1