« List of all CVEs

CVE-2017-0901

Published: 8/31/2017 Last updated: 9/16/2024 Reserved: 11/30/2016

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

CNA assigner: hackerone (36234546-b8fa-4601-9d6f-f4e334aa8ea1) Requested by: n/a

Opam packages affected (1)

conf-ruby

Products affected (1)

Product Vendor Version
RubyGems HackerOne Version 1809 for ARM64-based Systems

References (30)