An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-mongo-docUpgrade rubygem-pg | May 4, 2022 | May 4, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | May 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygemsUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-openssl | Sep 28, 2023 | May 4, 2020 |
| Centos_linux | — | Upgrade rubygem-pgUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-bundler-docUpgrade rubygem-bundlerUpgrade ruby-debuginfoUpgrade rubygem-bsonUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-bson-docUpgrade rubygem-abrtUpgrade rubygem-openssl-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-minitest | Jun 30, 2021 | May 4, 2020 |
| Debian | — | Upgrade ruby2.7 | Jul 10, 2020 | May 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | May 27, 2020 | May 4, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | May 4, 2020 |
| Oracle_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade rubygem-xmlrpcUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-mongo-doc | Jul 2, 2021 | Mar 31, 2020 |
| Redhat_linux | — | Upgrade rubygem-mysql2-debugsourceUpgrade rubygemsUpgrade rubygem-bson-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade rubygem-minitestUpgrade ruby-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-bson-debuginfoUpgrade ruby-irbUpgrade rubygem-openssl-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-mongo-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-did_you_meanUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-mysql2-docUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-opensslUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-irb | Jun 30, 2021 | May 4, 2020 |
| Rocky_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-json-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade ruby-libs-debuginfo | May 5, 2022 | May 4, 2020 |
| Suse | — | Upgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc | May 7, 2020 | May 4, 2020 |
| Ubuntu | — | Upgrade libruby2.5Upgrade libruby2.7Upgrade ruby2.7Upgrade ruby2.3Upgrade ruby2.5Upgrade libruby2.3 | Mar 19, 2021 | May 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub