Added CVE-2017-0899, CVE-2017-0900, CVE-2017-0901, and CVE-2017-0902 for rubygems.

Author: postmodern

libraries/rubygems/CVE-2017-0899.yml

@@ -0,0 +1,13 @@
+---
+library: rubygems
+cve: 2017-0899
+url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
+title: RubyGems ANSI escape sequence vulnerability
+date: 2017-08-29
+description: |
+  RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
+  specifications that include terminal escape characters. Printing the gem
+  specification would execute terminal escape sequences.
+cvss_v2: 7.5
+patched_versions:
+  - ">= 2.6.13"

libraries/rubygems/CVE-2017-0900.yml

@@ -0,0 +1,13 @@
+---
+library: rubygems
+cve: 2017-0900
+url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
+title: RubyGems DoS vulnerability in the query command
+date: 2017-08-29
+description: |
+  RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem
+  specifications to cause a denial of service attack against RubyGems clients
+  who have issued a `query` command.
+cvss_v2: 5.0
+patched_versions:
+  - ">= 2.6.13"

libraries/rubygems/CVE-2017-0901.yml

@@ -0,0 +1,13 @@
+---
+library: rubygems
+cve: 2017-0901
+url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
+title: RubyGems vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files
+date: 2017-08-29
+description: |
+  RubyGems version 2.6.12 and earlier fails to validate specification names,
+  allowing a maliciously crafted gem to potentially overwrite any file on the
+  filesystem.
+cvss_v2: 6.4
+patched_versions:
+  - ">= 2.6.13"

libraries/rubygems/CVE-2017-0902.yml

@@ -0,0 +1,13 @@
+---
+library: rubygems
+cve: 2017-0902
+url: http://blog.rubygems.org/2017/08/27/2.6.13-released.html
+title: RubyGems DNS request hijacking vulnerability
+date: 2017-08-29
+description: |
+  RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking
+  vulnerability that allows a MITM attacker to force the RubyGems client to
+  down load and install gems from a server that the attacker controls.
+cvss_v2: 6.8
+patched_versions:
+  - ">= 2.6.13"