CVE-2017-0902

PoC ×2—

CVSS 3.0

8.1 high

EPSS

5%p91

Published

Aug 31, 2017 (Aug 31, 2017)

Modified

Jun 17, 2026

Description

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

Vendors: rubygems debian canonical redhat
Products: rubygems, debian linux, ubuntu linux, enterprise linux desktop, enterprise linux server, enterprise linux server aus, enterprise linux server eus, enterprise linux server tus, enterprise linux workstation
Weakness: CWE-350, CWE-346
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.8%)

In the news0 stories

No ingested article mentions this CVE yet.