Contents

---
gem: rubygems-update
library: rubygems
cve: 2017-0901
url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
title: RubyGems vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files
date: 2017-08-29
description: |
  RubyGems version 2.6.12 and earlier fails to validate specification names,
  allowing a maliciously crafted gem to potentially overwrite any file on the
  filesystem.
cvss_v2: 6.4
patched_versions:
  - ">= 2.4.5.3"
  - ">= 2.5.2.1"
  - ">= 2.6.13"

Version data entries

1 entries across 1 versions & 1 rubygems

Version	Path
bundler-audit-0.7.0.1	data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0901.yml