CVE ID:	CVE-2017-0903
Description:	RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Test IDs:	1.3.6.1.4.1.25623.1.0.891421   1.3.6.1.4.1.25623.1.0.704031   1.3.6.1.4.1.25623.1.0.874125   1.3.6.1.4.1.25623.1.1.12.2021.3685.2   1.3.6.1.4.1.25623.1.0.874041
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2017-0903 BugTraq ID: 101275 http://www.securityfocus.com/bid/101275 Debian Security Information: DSA-4031 (Google Search) https://www.debian.org/security/2017/dsa-4031 http://blog.rubygems.org/2017/10/09/2.6.14-released.html http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49 https://hackerone.com/reports/274990 https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html RedHat Security Advisories: RHSA-2017:3485 https://access.redhat.com/errata/RHSA-2017:3485 RedHat Security Advisories: RHSA-2018:0378 https://access.redhat.com/errata/RHSA-2018:0378 RedHat Security Advisories: RHSA-2018:0583 https://access.redhat.com/errata/RHSA-2018:0583 RedHat Security Advisories: RHSA-2018:0585 https://access.redhat.com/errata/RHSA-2018:0585 https://usn.ubuntu.com/3553-1/ https://usn.ubuntu.com/3685-1/