{
  "threat_severity" : "Moderate",
  "public_date" : "2017-10-10T00:00:00Z",
  "bugzilla" : {
    "description" : "rubygems: Unsafe object deserialization through YAML formatted gem specifications",
    "id" : "1500488",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1500488"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.6",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-20",
  "details" : [ "RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.", "A vulnerability was found where the rubygems module was vulnerable to an unsafe YAML deserialization when inspecting a gem. Applications inspecting gem files without installing them can be tricked to execute arbitrary code in the context of the ruby interpreter." ],
  "statement" : "This issue did not affect the versions of rubygems as shipped with Red Hat Enterprise Linux 6.\nThis issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2018-02-28T00:00:00Z",
    "advisory" : "RHSA-2018:0378",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "ruby-0:2.0.0.648-33.el7_4"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 6",
    "release_date" : "2017-12-19T00:00:00Z",
    "advisory" : "RHSA-2017:3485",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el6",
    "package" : "rh-ruby24-ruby-0:2.4.2-86.el6"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 6",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0583",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el6",
    "package" : "rh-ruby22-ruby-0:2.2.9-19.el6"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 6",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0585",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el6",
    "package" : "rh-ruby23-ruby-0:2.3.6-67.el6"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS",
    "release_date" : "2017-12-19T00:00:00Z",
    "advisory" : "RHSA-2017:3485",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el6",
    "package" : "rh-ruby24-ruby-0:2.4.2-86.el6"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0583",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el6",
    "package" : "rh-ruby22-ruby-0:2.2.9-19.el6"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0585",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el6",
    "package" : "rh-ruby23-ruby-0:2.3.6-67.el6"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2017-12-19T00:00:00Z",
    "advisory" : "RHSA-2017:3485",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby24-ruby-0:2.4.2-86.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0583",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby22-ruby-0:2.2.9-19.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0585",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby23-ruby-0:2.3.6-67.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS",
    "release_date" : "2017-12-19T00:00:00Z",
    "advisory" : "RHSA-2017:3485",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby24-ruby-0:2.4.2-86.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0583",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby22-ruby-0:2.2.9-19.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0585",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby23-ruby-0:2.3.6-67.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS",
    "release_date" : "2017-12-19T00:00:00Z",
    "advisory" : "RHSA-2017:3485",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby24-ruby-0:2.4.2-86.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0583",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby22-ruby-0:2.2.9-19.el7"
  }, {
    "product_name" : "Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS",
    "release_date" : "2018-03-26T00:00:00Z",
    "advisory" : "RHSA-2018:0585",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3::el7",
    "package" : "rh-ruby23-ruby-0:2.3.6-67.el7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "rubygems",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise MRG 2",
    "fix_state" : "Not affected",
    "package_name" : "rubygems",
    "cpe" : "cpe:/a:redhat:enterprise_mrg:2"
  }, {
    "product_name" : "Red Hat Satellite 6",
    "fix_state" : "Not affected",
    "package_name" : "rubygems",
    "cpe" : "cpe:/a:redhat:satellite:6"
  }, {
    "product_name" : "Red Hat Subscription Asset Manager",
    "fix_state" : "Not affected",
    "package_name" : "ruby193-rubygems",
    "cpe" : "cpe:/a:rhel_sam:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2017-0903\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-0903\nhttp://blog.rubygems.org/2017/10/09/2.6.14-released.html" ],
  "name" : "CVE-2017-0903",
  "csaw" : false
}