Date: Mon, 9 Oct 2017 20:04:37 -0700 From: Aaron Patterson <tenderlove@...y-lang.org> To: security@...e.de, oss-security@...ts.openwall.com, ruby-security-ann@...glegroups.com Subject: [CVE-2017-0903] Unsafe Object Deserialization Vulnerability in RubyGems # Unsafe Object Deserialization Vulnerability in RubyGems There is a possible unsafe object desrialization vulnerability in RubyGems. It is possible for YAML deserialization of gem specifications to bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. This vulnerability has been assigned the CVE identifier CVE-2017-0903. Versions Affected: >= 2.0.0. Not affected: < 2.0.0 Fixed Versions: 2.6.14 Impact ------ When packaging a Gem, RubyGems will store information about the gem (the "specification") inside the Gem package, and formatted as YAML. When reading Gem information, RubyGems will parse that YAML. Without safeguards, YAML can be used to instantiate objects in a target system. If an attacker knows about the target system, they can use these instantiated objects as a way to escalate to an RCE via other means like `Marshal.load`. Normally, a remote code execution flaw isn't a problem in RubyGems because RubyGems is designed to execute arbitrary code any time a Gem is installed. However, services that process Gems like RubyGems.org can be impacted by this. In other words, when used as a client, RubyGems is not impacted. Applications that process Gems on the server are impacted. Releases -------- The FIXED releases are available at the normal locations. Workarounds ----------- For users that can't patch or upgrade, the following monkey patch will mitigate this risk: ``` module Gem class Specification WHITELISTED_CLASSES = %w( Symbol Time Date Gem::Dependency Gem::Platform Gem::Requirement Gem::Specification Gem::Version Gem::Version::Requirement ) WHITELISTED_SYMBOLS = %w( development runtime ) def self.from_yaml(input) input = normalize_yaml_input input spec = Psych.safe_load(input, WHITELISTED_CLASSES, WHITELISTED_SYMBOLS, true) fail Gem::EndOfYAMLException if spec && spec.class == FalseClass unless Gem::Specification === spec fail Gem::Exception, "YAML data doesn't evaluate to gem specification" end spec.specification_version ||= NONEXISTENT_SPECIFICATION_VERSION spec.reset_nil_attributes_to_default spec end end class Package def read_checksums gem Gem.load_yaml @checksums = gem.seek 'checksums.yaml.gz' do |entry| Zlib::GzipReader.wrap entry do |gz_io| Psych.safe_load(gz_io.read, Gem::Specification::WHITELISTED_CLASSES, Gem::Specification::WHITELISTED_SYMBOLS, true) end end end end end Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 2-6-whitelist-bypass.patch - Patch for 2.6 series Please note that only the 2.6.x series is supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. Credits ------- Thanks to Max Justicz ( https://mastodon.mit.edu/@maxj ) for reporting this! -- Aaron Patterson http://tenderlovemaking.com/ View attachment "2-6-whitelist-bypass.patch" of type "text/plain" (4675 bytes) Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.