An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 users, a fixed version is rdoc 6.3.4.1. For Ruby 3.1 users, a fixed version is rdoc 6.4.1.1. For Ruby 3.2 users, a fixed version is rdoc 6.5.1.1.
CVSS Details
- CVSS 3.1 Base Score: 4.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-raccUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-mongo-docUpgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-rssUpgrade ruby-bundled-gemsUpgrade rubygem-abrt-docUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-bson-docUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-rdoc | Jun 3, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade ruby | Jun 6, 2024 | May 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ruby-tcltkUpgrade rubygem-rbsUpgrade ruby-default-gemsUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade ruby-irbUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-rssUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-rexml | Jun 26, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-debuginfoUpgrade ruby3.2Upgrade ruby3.2-develUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygems | Feb 17, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade ruby3.1Upgrade ruby2.7 | May 6, 2024 | May 6, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rdoc. | Jun 24, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jul 16, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 26, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Oct 8, 2024 | May 14, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade rubygems-develUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-raccUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade rubygem-rbsUpgrade ruby-irbUpgrade ruby-default-gemsUpgrade rubygem-mongoUpgrade rubygem-opensslUpgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade rubygem-rssUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-irbUpgrade rubygem-power_assert | Jun 1, 2024 | Mar 21, 2024 |
| Redhat_linux | — | Upgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade ruby-irbUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-opensslUpgrade rubygem-pg-docUpgrade rubygem-pg-debuginfoUpgrade rubyUpgrade ruby-libsUpgrade rubygem-bson-docUpgrade rubygem-abrtUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-typeprofUpgrade ruby-default-gemsUpgrade rubygem-bson-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-raccUpgrade rubygem-pg-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-jsonUpgrade rubygem-bundler-docUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-racc-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-mongo-docUpgrade rubygems-develUpgrade rubygem-rexmlUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psych-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-bsonUpgrade ruby-develNo solution existsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rssUpgrade rubygem-bundler | May 31, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-raccUpgrade rubygem-bson-debugsourceUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-opensslUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-pg | Jun 17, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade ruby3.1Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade libruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.1Upgrade ruby3.2Upgrade ruby2.7Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro) | Jun 21, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub