CVE-2017-7540 json
Safemode Gem Has Incomplete List of Disallowed Inputs
published 2017-07-21 9 y ago modified 2026-06-17 4 mo ago also GHSA-5vx5-9q73-wgp4 , EUVD-2017-0171
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
Patch / fix
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-7540 updated cvss 7.5
rubygem-safemode: Bypassing the whitelist of safe commands via block_pass
-
Red Hat Ceph Storage 1.3 ruby193-rubygem-safemode Red Hat Enterprise Linux OpenStack Platform 6 (Juno) Installer ruby193-rubygem-safemodeaffected: no fix planned “Will not fix”
-
Red Hat Satellite 6 ruby193-rubygem-safemodeaffected: no fix available
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.63% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | safemode | <1.3.2 |
1.3.2 |
Affected products
- Red Hat, Inc. rubygem-safemode
Classification
- Weakness
-
- CWE-184 Incomplete List of Disallowed Inputs
References
Sources
- CVE List CVE-2017-7540
- GitHub Advisory GHSA-5vx5-9q73-wgp4
- NVD CVE-2017-7540
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.