Vulnerability in RubyGems Allows File Overwrite (CVE-2017-0901)
Summary
CVE-2017-0901: RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem. Affects ruby across 2 version ranges.
< 2.4.2-r0
< ad5c0a53a86ca5b218c7976765c0365b91d22cb2
Fixed in 2.4.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RubyGems is a package manager for the Ruby programming language. It allows users to easily install, manage, and update Ruby libraries and dependencies. However, versions 2.6.12 and earlier of RubyGems fail to validate specification names, which can be exploited by a maliciously crafted gem to potentially overwrite any file on the filesystem.
Vulnerability Detail
The vulnerability (CVE-2017-0901) in RubyGems arises from the lack of validation of specification names. This allows an attacker to create a gem with a specially crafted name that can overwrite any file on the system. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive files, modify critical system configurations, or disrupt the normal functioning of the affected system. The CVSS score for this vulnerability is 7.5, indicating a high severity.
How To Fix
Minimum fixed version
2.4.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating RubyGems to the latest version.
Conclusion
The vulnerability in RubyGems (CVE-2017-0901) allows a maliciously crafted gem to overwrite any file on the filesystem. To mitigate this risk, it is crucial to update RubyGems to version 2.4.2-r0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
RubyGems is a package manager for the Ruby programming language, allowing easy installation and management of Ruby libraries and dependencies.
This vulnerability allows an attacker to overwrite any file on the system, potentially leading to unauthorized access, data loss, or system disruption.
To fix this vulnerability, update RubyGems to version 2.4.2-r0 or later.
No, there is no known workaround. It is crucial to update RubyGems to the latest version.
The CVSS score for this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
