CVE-2017-0899: Code Injection

August 31, 2017 (updated October 9, 2019)

RubyGems is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

References

blog.rubygems.org/2017/08/27/2.6.13-released.html
www.securityfocus.com/bid/100576
www.securitytracker.com/id/1039249
nvd.nist.gov/vuln/detail/CVE-2017-0899

Code Behaviors & Features

Detect and mitigate CVE-2017-0899 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →