CVE-2017-0900: Improper Input Validation

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a query command...

CVE-2017-0900

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a query command...

PT-2017-10701

Name of the Vulnerable Software and Affected Versions RubyGems versions 2.6.12 and earlier Description The issue allows maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a query command. Recommendations For RubyGems versions 2.6.12...

RubyGems Denial of Service Vulnerability (CNVD-2017-30734)

RubyGems is a Ruby package manager from the RubyGems organization, which is used to distribute and manage Ruby packages. A security vulnerability exists in RubyGems 2.6.12 and earlier versions. An attacker can exploit this vulnerability to cause a denial of service...

UBUNTU-CVE-2017-0900

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a query command...

PT-2017-3268

Name of the Vulnerable Software and Affected Versions RubyGems versions 2.6.12 and earlier Description The issue exists due to insufficient input validation in the package manager. Exploitation of this issue may allow a remote attacker to overwrite any file on the filesystem. A maliciously crafte...

PT-2017-10702

Name of the Vulnerable Software and Affected Versions RubyGems versions 2.6.12 and earlier Description The issue allows a man-in-the-middle MITM attacker to force the RubyGems client to download and install gems from a server controlled by the attacker through a DNS hijacking vulnerability...

PT-2017-10700

Name of the Vulnerable Software and Affected Versions RubyGems versions 2.6.12 and earlier Description The issue allows maliciously crafted gem specifications that include terminal escape characters to execute terminal escape sequences when the gem specification is printed. This could potentially...

CVE-2017-0901: Improper Limitation of a Pathname to a Restricted Directory

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem...

RubyGems Secure Bypass Leakage (CNVD-2017-30738)

RubyGems is a Ruby package manager from the RubyGems organization, which is used to distribute and manage Ruby packages. A security vulnerability exists in RubyGems 2.6.12 and earlier versions. An attacker can exploit the vulnerability to inject malicious commands into a user's terminal and execu...

CVE-2017-0902: Reliance on Reverse DNS Resolution for a Security-Critical Action

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

UBUNTU-CVE-2017-0899

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences...

FreeBSD : rubygems -- multiple vulnerabilities (3f6de636-8cdb-11e7-9c71-f0def1fd7ea2)

Official blog of RubyGems reports : The following vulnerabilities have been reported: a DNS request hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS vulnerability in the query command, and a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrar...

RubyGems vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem...

rubygems -- multiple vulnerabilities

Official blog of RubyGems reports: The following vulnerabilities have been reported: a DNS request hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS vulnerability in the query command, and a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary...

RubyGems DNS request hijacking vulnerability

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to down load and install gems from a server that the attacker controls...

RubyGems ANSI escape sequence vulnerability

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences...

RubyGems DoS vulnerability in the query command

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a query command...

From the SSRF implementation chain to the RCE, see How do I use the GitHub Enterprise version of the four vulnerability-vulnerability warning-the black bar safety net

In the past few months, I have been seriously preparing for the 2017 America the Black Hat hacker conference and DEF CON 25 lecture content, and become a Black Hat and DEFCON speaker has always been in my life a very important goal. In addition, this is also my first time in such a formal occasio...

Gitrob - Reconnaissance Tool for GitHub Organizations

Gitrob is a command line tool which can help organizations and security professionals find sensitive information lingering in publicly available files on GitHub. The tool will iterate over all public organization and member repositories and match filenames against a range of patterns for files th...