Vulnerability in RubyGems: Execution of Terminal Escape Sequences
Summary
CVE-2017-0899: RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Affects ruby across 3 version ranges.
< 1bcbc7fe637b03145401ec9c094066285934a7f1
< 2.4.2-r0
< ef0aa611effb5f54d40c7fba6e8235eb43c5a491
Fixed in 2.4.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RubyGems is a package manager for the Ruby programming language. It allows users to easily install, manage, and update Ruby libraries and dependencies. However, versions 2.6.12 and earlier of RubyGems are vulnerable to a specific issue. When processing gem specifications that include terminal escape characters, the printing of these specifications can lead to the execution of terminal escape sequences.
Vulnerability Detail
The vulnerability, identified as CVE-2017-0899, arises from a lack of proper sanitization of gem specifications. An attacker can create a malicious gem specification that includes terminal escape characters. When this gem specification is printed, the terminal escape sequences are executed, potentially leading to unauthorized actions or system compromise. The impact of this vulnerability can range from unauthorized access to sensitive information to complete control over the affected system.
How To Fix
Minimum fixed version
2.4.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update RubyGems to the fixed version as soon as possible.
Conclusion
The vulnerability in RubyGems that allows for the execution of terminal escape sequences can have severe consequences, including unauthorized access and system compromise. It is highly recommended to update RubyGems to version 2.4.2-r0 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
RubyGems is a package manager for the Ruby programming language. It allows users to easily install, manage, and update Ruby libraries and dependencies.
The vulnerability allows for the execution of terminal escape sequences, which can lead to unauthorized actions or system compromise. The impact can range from unauthorized access to sensitive information to complete control over the affected system.
To fix this vulnerability, update RubyGems to version 2.4.2-r0 or later.
There is no known workaround for this vulnerability. It is crucial to update RubyGems to the fixed version as soon as possible.
For more information about this vulnerability, you can refer to the CVE-2017-0899 entry or the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
