In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-minitestUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubyUpgrade ruby-tcltkUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby22Upgrade ruby23Upgrade ruby20Upgrade ruby24 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Apply Apple macOS Security Update 2018-002 High SierraUpgrade macOS to the latest version | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade ruby-debuginfoUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-tcltkUpgrade ruby-docUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-psych | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby2.5Upgrade ruby1.8 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade ruby-develUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-psychUpgrade rubyUpgrade ruby-libsUpgrade rubygem-json | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygemsUpgrade rubygems-develUpgrade ruby-libsUpgrade ruby-tcltkUpgrade ruby-irbUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubyUpgrade ruby-docUpgrade rubygem-psychNo solution existsUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-io-console | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade ruby2.1Upgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.1-develUpgrade yast2-ruby-bindings | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade ruby2.0Upgrade libruby2.0Upgrade ruby1.9.1Upgrade libruby1.9.1Upgrade ruby2.3Upgrade libruby2.3Upgrade ruby1.9.3 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub