Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade rubygem-mongoUpgrade rubygem-abrt | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-bundlerUpgrade ruby-debuginfoUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-xmlrpcUpgrade rubygem-irb | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrtUpgrade rubygem-minitestUpgrade rubygem-bson-debugsourceUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bundler-docUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mongoUpgrade rubyUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade ruby-irbUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygems-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-io-console-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-abrtUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-pg-docUpgrade rubygem-opensslUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-xmlrpcUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-bson-doc | Jul 2, 2021 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade rubygem-bigdecimalNo solution existsUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubygem-abrtUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-irbUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade rubygems | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-psych-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade ruby2.1-develUpgrade ruby2.1Upgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade ruby2.1-stdlibUpgrade ruby2.5-devel-extra | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.5Upgrade libruby2.5Upgrade libruby2.3Upgrade ruby2.3 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub