An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 16, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubyUpgrade ruby-tcltkUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygems-devel | Apr 27, 2020 | Nov 16, 2018 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby23Upgrade ruby20 | Dec 7, 2018 | Oct 17, 2018 |
| Centos_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade ruby-tcltkUpgrade ruby-docUpgrade rubygem-jsonUpgrade ruby | Aug 28, 2019 | Nov 16, 2018 |
| Debian | — | Upgrade ruby2.5 | Nov 4, 2018 | Oct 17, 2018 |
| Freebsd | — | Upgrade ruby | Oct 21, 2018 | Oct 20, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jul 23, 2019 | Nov 16, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | May 7, 2019 | Nov 16, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | May 7, 2019 | Nov 16, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Nov 16, 2018 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade ruby-docUpgrade rubygemsUpgrade ruby-libsUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade rubygem-rake | Jul 21, 2020 | Oct 17, 2018 |
| Redhat_linux | — | Upgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade rubygemsNo solution existsUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubyUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-minitestUpgrade ruby-irbUpgrade ruby-tcltk | Aug 7, 2019 | Nov 16, 2018 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.5-develUpgrade ruby2.1Upgrade libruby2_1-2_1Upgrade ruby2.1-develUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.1-stdlibUpgrade yast2-ruby-bindings | Jul 22, 2019 | Oct 17, 2018 |
| Ubuntu | — | Upgrade libruby2.0Upgrade libruby2.3Upgrade ruby1.9.3Upgrade ruby2.3Upgrade ruby2.0Upgrade libruby2.5Upgrade libruby1.9.1Upgrade ruby2.5Upgrade ruby1.9.1 | Nov 13, 2018 | Oct 17, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 16, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub