RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rubyUpgrade ruby2.2 | Aug 22, 2024 | Aug 31, 2017 |
| Amazon_linux | — | Upgrade ruby23Upgrade ruby24Upgrade ruby22 | Oct 3, 2017 | Aug 31, 2017 |
| Centos_linux | — | Upgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-rakeUpgrade ruby-tcltkUpgrade rubyUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-rdoc | Mar 13, 2018 | Aug 31, 2017 |
| Debian | — | Upgrade ruby1.9.1Upgrade rubygems | Dec 5, 2017 | Aug 31, 2017 |
| Gentoo Linux | — | Upgrade dev-ruby/rubygems. | Oct 30, 2017 | Aug 31, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Mar 16, 2018 | Aug 31, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Mar 16, 2018 | Aug 31, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Aug 31, 2017 |
| Oracle_linux | — | Upgrade ruby-libsUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygems-develUpgrade rubygems | Mar 1, 2018 | Sep 1, 2017 |
| Redhat_linux | — | Upgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-psychNo solution existsUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubyUpgrade ruby-docUpgrade ruby-libs | Mar 1, 2018 | Aug 31, 2017 |
| Suse | — | Upgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade libruby2_1-2_1Upgrade ruby2.1-develUpgrade yast2-ruby-bindings | Jun 10, 2020 | Aug 31, 2017 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby1.9.3 | Oct 5, 2017 | Aug 31, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub