Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2017-0899

28
FAUCET Score

CVE-2017-0899 affects RubyGems versions 2.6.12 and earlier, allowing maliciously crafted gem specifications containing terminal escape characters to execute arbitrary commands when printed. This critical vulnerability, with a CVSS score of 9.8, presents a severe risk due to its network-based attack vector, low complexity, and potential for complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, indicating awareness within the security community.

Impacted Technologies

VendorProductVersion(s)CPE
<= 2.6.12CPE matchmatch criteria
cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
10.81%
Probability of exploitation in next 30 days
EPSS Percentile
95.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.1081 is in the 91st percentile among its peer group of 36,821 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (22)

github_advisorypatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: ruby-0:2.0.0.648-33.el7_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby24-ruby-0:2.4.2-86.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby22-ruby-0:2.2.9-19.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby23-ruby-0:2.3.6-67.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-ruby24-ruby-0:2.4.2-86.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-ruby22-ruby-0:2.2.9-19.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-ruby23-ruby-0:2.3.6-67.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby24-ruby-0:2.4.2-86.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby22-ruby-0:2.2.9-19.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby23-ruby-0:2.3.6-67.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-ruby24-ruby-0:2.4.2-86.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-ruby22-ruby-0:2.2.9-19.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-ruby23-ruby-0:2.3.6-67.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby24-ruby-0:2.4.2-86.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby23-ruby-0:2.3.6-67.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby22-ruby-0:2.2.9-19.el7
View patch
rubygemspatch availablevia ghsa
Product: rubygems-updateFixed in: 2.6.13
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise MRG 2Fixed in: rubygems
redhatvendor investigatingvia redhat_api
Product: Red Hat Satellite 6Fixed in: rubygems
redhatvendor investigatingvia redhat_api
Product: Red Hat Subscription Asset ManagerFixed in: ruby193-rubygems
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: rubygems

Vendor Advisories (2)

rubygemsGHSA-7gcp-2gmq-w3xhcritical

RubyGems Code Injection vulnerability

May 13, 2022
redhatCVE-2017-0899Low

rubygems: Escape sequence in the "summary" field of gemspec

Aug 31, 2017

References

blog.rubygems.org / 2017/08/27/2.6.13-released.html
PatchVendor Advisory
access.redhat.com / errata/RHSA-2017:3485
Third Party Advisory
access.redhat.com / errata/RHSA-2018:0378
Third Party Advisory
access.redhat.com / errata/RHSA-2018:0583
Third Party Advisory
access.redhat.com / errata/RHSA-2018:0585
Third Party Advisory
github.com / rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1
PatchThird Party Advisory
github.com / rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491
PatchThird Party Advisory
hackerone.com / reports/226335
ExploitPatchThird Party Advisory
lists.debian.org / debian-lts-announce/2018/07/msg00012.html
Mailing ListThird Party Advisory
security.gentoo.org / glsa/201710-01
Third Party Advisory
debian.org / security/2017/dsa-3966
Third Party Advisory
securityfocus.com / bid/100576
Third Party AdvisoryVDB Entry
securitytracker.com / id/1039249
Third Party AdvisoryVDB Entry