ALPINE-CVE-2017-0899 PUBLISHED CVSS 9.800000190734863 CRITICAL

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

Risk Scores

CVSS v3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Alpine:v3.19ruby1.8.7_p299-r1, 1.8.7_p299-r2, 1.8.7_p352-r0
Alpine:v3.6ruby1.8.7_p174-r0, 2.4.1-r3, 2.4.1-r2
Alpine:v3.14ruby2.4.1-r5, 2.3.3-r0, 2.3.3-r1
Alpine:v3.22ruby0, 0, 0
Alpine:v3.18ruby0, 2.4.1-r5, 2.4.1-r4
Alpine:v3.21ruby0, 0, 0
Alpine:v3.15ruby1.8.7_p299-r0, 1.8.7_p299-r1, 1.8.7_p299-r2
Alpine:v3.10ruby1.8.7_p174-r2, 0, 2.4.1-r5
Alpine:v3.3ruby2.0.0_p247-r0, 0, 1.8.7_p160-r2
Alpine:v3.7ruby2.4.1-r5, 2.4.1-r4, 2.4.1-r3
Alpine:v3.16ruby1.9.3_p374-r0, 1.9.3_p385-r0, 1.9.3_p392-r0
Alpine:v3.17ruby2.2.4-r0, 0, 1.8.7_p160-r2
Alpine:v3.20ruby0, 0, 0
Alpine:v3.5ruby1.8.7_p174-r6, 1.8.7_p174-r7, 1.8.7_p299-r0
Alpine:v3.12ruby1.8.7_p299-r0, 1.8.7_p174-r7, 1.8.7_p174-r6
Alpine:v3.23ruby0, 0, 0
Alpine:v3.4ruby2.0.0_p247-r1, 0, 1.8.7_p160-r2
Alpine:v3.9ruby2.1.5-r1, 2.1.5-r0, 2.0.0_p481-r0
Alpine:v3.11ruby2.1.5-r0, 2.0.0_p481-r0, 2.0.0_p353-r2
Alpine:v3.13ruby2.4.1-r5, 0, 1.8.7_p160-r2

…and 1 more

Timeline

References

Open in Interactive Console →