CVE-2017-0900
Fixed in a distro release EPSS 8%
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.
Products: rubygems, debian_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rubygems-update | 2.6.13 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | ruby | 2.4.2-r0 |
| Alpine 3.11 | ruby | 2.4.2-r0 |
| Alpine 3.12 | ruby | 2.4.2-r0 |
| Alpine 3.13 | ruby | 2.4.2-r0 |
| Alpine 3.14 | ruby | 2.4.2-r0 |
| Alpine 3.15 | ruby | 2.4.2-r0 |
| Alpine 3.16 | ruby | 2.4.2-r0 |
| Alpine 3.17 | ruby | 2.4.2-r0 |
| Alpine 3.18 | ruby | 2.4.2-r0 |
| Alpine 3.19 | ruby | 2.4.2-r0 |
| Alpine 3.20 | ruby | 2.4.2-r0 |
| Alpine 3.21 | ruby | 2.4.2-r0 |
| Alpine 3.22 | ruby | 2.4.2-r0 |
| Alpine 3.23 | ruby | 2.4.2-r0 |
| Alpine 3.24 | ruby | 2.4.2-r0 |
| Alpine 3.3 | ruby | 2.2.8-r0 |
| Alpine 3.4 | ruby | 2.3.5-r0 |
| Alpine 3.5 | ruby | 2.3.5-r0 |
| Alpine 3.6 | ruby | 2.4.2-r0 |
| Alpine 3.7 | ruby | 2.4.2-r0 |
| Alpine 3.8 | ruby | 2.4.2-r0 |
| Alpine 3.9 | ruby | 2.4.2-r0 |
| Debian 12 | rubygems | 3.2.0~rc.1-1 |
| Debian 13 | rubygems | 3.2.0~rc.1-1 |
| Debian 14 | rubygems | 3.2.0~rc.1-1 |
| Debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u6 |
| Debian 7 | rubygems | 1.8.24-1+deb7u1 |
| Debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| Debian 9 | ruby2.3 | 2.3.3-1+deb9u1 |
| Red Hat Enterprise Linux 7 | ruby | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-debuginfo | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-devel | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-doc | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-irb | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-libs | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-tcltk | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-bigdecimal | 0:1.2.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-io-console | 0:0.4.2-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-json | 0:1.7.7-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-minitest | 0:4.3.2-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-psych | 0:2.0.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-rake | 0:0.9.6-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-rdoc | 0:4.0.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygems | 0:2.0.14.1-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygems-devel | 0:2.0.14.1-33.el7_4 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-debuginfo | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-debuginfo | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-devel | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-devel | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-doc | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-doc | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-irb | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-irb | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-libs | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-libs | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-tcltk | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-tcltk | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-bigdecimal | 0:1.2.6-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-bigdecimal | 0:1.2.6-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-io-console | 0:0.4.3-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-io-console | 0:0.4.3-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-json | 0:1.8.1.1-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-json | 0:1.8.1.1-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-minitest | 0:5.4.3-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-minitest | 0:5.4.3-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-power_assert | 0:0.2.2-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-power_assert | 0:0.2.2-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-psych | 0:2.0.8.1-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-psych | 0:2.0.8.1-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rake | 0:10.4.2-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rake | 0:10.4.2-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rdoc | 0:4.2.0-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rdoc | 0:4.2.0-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-test-unit | 0:3.0.8-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-test-unit | 0:3.0.8-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems | 0:2.4.5.4-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems | 0:2.4.5.4-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems-devel | 0:2.4.5.4-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems-devel | 0:2.4.5.4-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-debuginfo | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-debuginfo | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-devel | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-devel | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-doc | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-doc | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-irb | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-irb | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-libs | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-libs | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-tcltk | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-tcltk | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-bigdecimal | 0:1.2.8-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-bigdecimal | 0:1.2.8-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-did_you_mean | 0:1.0.0-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-did_you_mean | 0:1.0.0-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-io-console | 0:0.4.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-io-console | 0:0.4.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-json | 0:1.8.3.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-json | 0:1.8.3.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-minitest | 0:5.8.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-minitest | 0:5.8.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-net-telnet | 0:0.1.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-net-telnet | 0:0.1.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-power_assert | 0:0.2.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-power_assert | 0:0.2.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-psych | 0:2.1.0.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-psych | 0:2.1.0.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rake | 0:10.4.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rake | 0:10.4.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rdoc | 0:4.2.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rdoc | 0:4.2.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-test-unit | 0:3.1.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-test-unit | 0:3.1.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems | 0:2.5.2.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems | 0:2.5.2.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems-devel | 0:2.5.2.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems-devel | 0:2.5.2.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-debuginfo | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-debuginfo | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-devel | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-devel | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-doc | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-doc | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-irb | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-irb | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-libs | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-libs | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-bigdecimal | 0:1.3.0-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-bigdecimal | 0:1.3.0-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-did_you_mean | 0:1.1.0-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-did_you_mean | 0:1.1.0-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-io-console | 0:0.4.6-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-io-console | 0:0.4.6-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-json | 0:2.0.4-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-json | 0:2.0.4-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-minitest | 0:5.10.1-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-minitest | 0:5.10.1-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-net-telnet | 0:0.1.1-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-net-telnet | 0:0.1.1-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-openssl | 0:2.0.5-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-openssl | 0:2.0.5-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-power_assert | 0:0.4.1-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-power_assert | 0:0.4.1-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-psych | 0:2.2.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-psych | 0:2.2.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rake | 0:12.0.0-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rake | 0:12.0.0-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rdoc | 0:5.0.0-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rdoc | 0:5.0.0-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-test-unit | 0:3.2.3-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-test-unit | 0:3.2.3-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-xmlrpc | 0:0.2.1-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-xmlrpc | 0:0.2.1-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems | 0:2.6.14-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems | 0:2.6.14-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems-devel | 0:2.6.14-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems-devel | 0:2.6.14-86.el7 |
| SUSE Enterprise Storage 5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE HPE Helion OpenStack 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud 7 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud 7 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE OpenStack Cloud 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | ruby2.1 | 2.1.9-19.3.2 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.5 |
| Ubuntu 16.04 LTS | jruby | no fix |
| Ubuntu 16.04 LTS | ruby2.3 | 2.3.1-2~16.04.6 |
| Ubuntu 18.04 LTS | jruby | no fix |
| Ubuntu 20.04 LTS | jruby | no fix |
| Ubuntu 24.04 LTS | jruby | no fix |
| Ubuntu 25.10 | jruby | no fix |
| Ubuntu 26.04 LTS | jruby | no fix |
| Ubuntu 26.10 | jruby | no fix |
| Ubuntu Pro 14.04 LTS | jruby | no fix |