CVE-2017-0902

22

FAUCET Score

CVE-2017-0902 describes a DNS hijacking vulnerability in RubyGems versions 2.6.12 and earlier, impacting products like Debian, Red Hat, and Canonical. This high-severity flaw (CVSS 8.1) allows a Man-in-the-Middle (MITM) attacker to force RubyGems clients to download and install malicious gems from an attacker-controlled server, leading to potential high impact on confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 2.6.12CPE matchmatch criteria	cpe:2.3:a:rubygems:rubygems::::::::
		8.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:8.0:::::::*
		9.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:9.0:::::::*
		14.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
		16.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::

CVSS Data

CVSS version used by this source: 3.0

8.1HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

2.2

Impact Score

5.9

CvssVersion

3.0

Exploit Intelligence

EPSS Score

4.75%

Probability of exploitation in next 30 days

EPSS Percentile

90.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0475 is in the 57th percentile among its peer group of 8,918 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (22)

github_advisorypatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: ruby-0:2.0.0.648-33.el7_4

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby24-ruby-0:2.4.2-86.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby22-ruby-0:2.2.9-19.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby23-ruby-0:2.3.6-67.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-ruby24-ruby-0:2.4.2-86.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-ruby22-ruby-0:2.2.9-19.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: rh-ruby23-ruby-0:2.3.6-67.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby24-ruby-0:2.4.2-86.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby22-ruby-0:2.2.9-19.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby23-ruby-0:2.3.6-67.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-ruby24-ruby-0:2.4.2-86.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-ruby22-ruby-0:2.2.9-19.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUSFixed in: rh-ruby23-ruby-0:2.3.6-67.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby24-ruby-0:2.4.2-86.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby23-ruby-0:2.3.6-67.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby22-ruby-0:2.2.9-19.el7

rubygemspatch availablevia ghsa

Product: rubygems-updateFixed in: 2.6.13

redhatvendor investigatingvia redhat_api

Product: Red Hat Enterprise MRG 2Fixed in: rubygems

redhatvendor investigatingvia redhat_api

Product: Red Hat Satellite 6Fixed in: rubygems

redhatvendor investigatingvia redhat_api

Product: Red Hat Subscription Asset ManagerFixed in: ruby193-rubygems

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: rubygems

Vendor Advisories (2)

rubygemsGHSA-73w7-6w9g-gc8whigh

RubyGems has Origin Validation Error vulnerability

redhatCVE-2017-0902Moderate

rubygems: DNS hijacking vulnerability

References

blog.rubygems.org / 2017/08/27/2.6.13-released.html

PatchVendor Advisory

access.redhat.com / errata/RHSA-2017:3485

Third Party Advisory

access.redhat.com / errata/RHSA-2018:0378

Third Party Advisory

access.redhat.com / errata/RHSA-2018:0583

Third Party Advisory

access.redhat.com / errata/RHSA-2018:0585

Third Party Advisory

github.com / rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32

ExploitPatchThird Party Advisory

hackerone.com / reports/218088

ExploitIssue TrackingThird Party Advisory

lists.debian.org / debian-lts-announce/2018/07/msg00012.html

Mailing ListThird Party Advisory

security.gentoo.org / glsa/201710-01

Third Party Advisory

usn.ubuntu.com / 3553-1

Third Party Advisory

usn.ubuntu.com / 3685-1

Third Party Advisory

debian.org / security/2017/dsa-3966

Third Party Advisory

securityfocus.com / bid/100586

Third Party AdvisoryVDB Entry

securitytracker.com / id/1039249

Third Party AdvisoryVDB Entry