In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
CVSS Details
- CVSS 3.1 Base Score: 3.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygemsUpgrade rubygem-pgUpgrade ruby-docUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-raccUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubygem-power_assertUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-abrt-docUpgrade rubygem-rake | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-libsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-docUpgrade ruby3.2-develUpgrade ruby3.2 | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade rubygemsUpgrade ruby2.7 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-rexmlUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-raccUpgrade rubygem-abrt-docUpgrade rubyUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-rbsUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-json | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade ruby-libsUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade ruby-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-rexmlUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade ruby-docNo solution existsUpgrade rubygemsUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-rssUpgrade rubygem-jsonUpgrade rubygem-racc-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rbsUpgrade rubygem-psych-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rakeUpgrade ruby-default-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-raccUpgrade rubygem-typeprofUpgrade rubygem-json-debuginfoUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-doc | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-raccUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbsUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psychUpgrade rubygem-pg | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc-ri | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade ruby3.2Upgrade libruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby3.0Upgrade libruby3.0Upgrade ruby2.7Upgrade libruby3.3Upgrade ruby3.3 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub