← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to active/CVE-2017-0902

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
active/CVE-2017-0902
1
 
PublicDateAtUSN: 2017-08-31
2
 
Candidate: CVE-2017-0902
3
 
PublicDate: 2017-08-31
4
 
References:
5
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0902
6
 
 https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/
7
 
 http://blog.rubygems.org/2017/08/27/2.6.13-released.html
8
 
 https://hackerone.com/reports/218088
9
 
 https://usn.ubuntu.com/usn/usn-3553-1
10
 
 https://usn.ubuntu.com/usn/usn-3685-1
11
 
Description:
12
 
 RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking
13
 
 vulnerability that allows a MITM attacker to force the RubyGems client to
14
 
 download and install gems from a server that the attacker controls.
15
 
Ubuntu-Description:
16
 
Notes:
17
 
 tyhicks> ruby{1.9.1,2.0,2.3} and jruby ship an embedded rubygems.
18
 
 leosilva> code not present in trusty for version 1.9.1
19
 
Bugs:
20
 
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=873802
21
 
Priority: medium
22
 
Discovered-by:
23
 
Assigned-to:
24
 
 
25
 
Patches_ruby1.9.1:
26
 
 upstream: https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32
27
 
 upstream: https://bugs.ruby-lang.org/attachments/download/6691/rubygems-2613-ruby23.patch
28
 
 upstream: https://bugs.ruby-lang.org/attachments/download/6690/rubygems-2613-ruby22.patch
29
 
upstream_ruby1.9.1: needs-triage
30
 
precise/esm_ruby1.9.1: DNE
31
 
trusty_ruby1.9.1: not-affected (code not present)
32
 
vivid/ubuntu-core_ruby1.9.1: DNE
33
 
xenial_ruby1.9.1: DNE
34
 
zesty_ruby1.9.1: DNE
35
 
artful_ruby1.9.1: DNE
36
 
bionic_ruby1.9.1: DNE
37
 
devel_ruby1.9.1: DNE
38
 
 
39
 
Patches_ruby2.0:
40
 
upstream_ruby2.0: needs-triage
41
 
precise/esm_ruby2.0: DNE
42
 
trusty_ruby2.0: released (2.0.0.484-1ubuntu2.10)
43
 
vivid/ubuntu-core_ruby2.0: DNE
44
 
xenial_ruby2.0: DNE
45
 
zesty_ruby2.0: DNE
46
 
artful_ruby2.0: DNE
47
 
bionic_ruby2.0: DNE
48
 
devel_ruby2.0: DNE
49
 
 
50
 
Patches_ruby2.3:
51
 
upstream_ruby2.3: needs-triage
52
 
precise/esm_ruby2.3: DNE
53
 
trusty_ruby2.3: DNE
54
 
vivid/ubuntu-core_ruby2.3: DNE
55
 
xenial_ruby2.3: released (2.3.1-2~16.04.6)
56
 
zesty_ruby2.3: ignored (reached end-of-life)
57
 
artful_ruby2.3: released (2.3.3-1ubuntu1.3)
58
 
bionic_ruby2.3: DNE
59
 
devel_ruby2.3: DNE
60
 
 
61
 
Patches_jruby:
62
 
upstream_jruby: needs-triage
63
 
precise/esm_jruby: DNE
64
 
trusty_jruby: needed
65
 
vivid/ubuntu-core_jruby: DNE
66
 
xenial_jruby: needed
67
 
zesty_jruby: ignored (reached end-of-life)
68
 
artful_jruby: needed
69
 
bionic_jruby: needed
70
 
devel_jruby: needed