CVE-2017-0903: rubygems: Unsafe object deserialization through YAML formatted gem specifications

Severity: Critical

CVSS Score: 9.8

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.