← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to active/CVE-2017-0901

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
active/CVE-2017-0901
1
 
PublicDateAtUSN: 2017-08-31
2
 
Candidate: CVE-2017-0901
3
 
PublicDate: 2017-08-31
4
 
References:
5
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0901
6
 
 https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/
7
 
 http://blog.rubygems.org/2017/08/27/2.6.13-released.html
8
 
 https://hackerone.com/reports/243156
9
 
 https://usn.ubuntu.com/usn/usn-3439-1
10
 
 https://usn.ubuntu.com/usn/usn-3553-1
11
 
 https://usn.ubuntu.com/usn/usn-3685-1
12
 
Description:
13
 
 RubyGems version 2.6.12 and earlier fails to validate specification names,
14
 
 allowing a maliciously crafted gem to potentially overwrite any file on the
15
 
 filesystem.
16
 
Ubuntu-Description:
17
 
Notes:
18
 
 tyhicks> ruby{1.9.1,2.0,2.3} and jruby ship an embedded rubygems.
19
 
Bugs:
20
 
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=873802
21
 
Priority: medium
22
 
Discovered-by:
23
 
Assigned-to:
24
 
 
25
 
Patches_ruby1.9.1:
26
 
 upstream: https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2
27
 
 upstream: https://bugs.ruby-lang.org/attachments/download/6691/rubygems-2613-ruby23.patch
28
 
 upstream: https://bugs.ruby-lang.org/attachments/download/6690/rubygems-2613-ruby22.patch
29
 
upstream_ruby1.9.1: needs-triage
30
 
precise/esm_ruby1.9.1: DNE
31
 
trusty_ruby1.9.1: released (1.9.3.484-2ubuntu1.5)
32
 
vivid/ubuntu-core_ruby1.9.1: DNE
33
 
xenial_ruby1.9.1: DNE
34
 
zesty_ruby1.9.1: DNE
35
 
artful_ruby1.9.1: DNE
36
 
bionic_ruby1.9.1: DNE
37
 
devel_ruby1.9.1: DNE
38
 
 
39
 
Patches_ruby2.0:
40
 
upstream_ruby2.0: needs-triage
41
 
precise/esm_ruby2.0: DNE
42
 
trusty_ruby2.0: released (2.0.0.484-1ubuntu2.10)
43
 
vivid/ubuntu-core_ruby2.0: DNE
44
 
xenial_ruby2.0: DNE
45
 
zesty_ruby2.0: DNE
46
 
artful_ruby2.0: DNE
47
 
bionic_ruby2.0: DNE
48
 
devel_ruby2.0: DNE
49
 
 
50
 
Patches_ruby2.3:
51
 
upstream_ruby2.3: needs-triage
52
 
precise/esm_ruby2.3: DNE
53
 
trusty_ruby2.3: DNE
54
 
vivid/ubuntu-core_ruby2.3: DNE
55
 
xenial_ruby2.3: released (2.3.1-2~16.04.6)
56
 
zesty_ruby2.3: ignored (reached end-of-life)
57
 
artful_ruby2.3: released (2.3.3-1ubuntu1.3)
58
 
bionic_ruby2.3: DNE
59
 
devel_ruby2.3: DNE
60
 
 
61
 
Patches_jruby:
62
 
upstream_jruby: needs-triage
63
 
precise/esm_jruby: DNE
64
 
trusty_jruby: needed
65
 
vivid/ubuntu-core_jruby: DNE
66
 
xenial_jruby: needed
67
 
zesty_jruby: ignored (reached end-of-life)
68
 
artful_jruby: needed
69
 
bionic_jruby: needed
70
 
devel_jruby: needed