In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-minitestUpgrade rubygem-rdocUpgrade ruby-tcltkUpgrade ruby-docUpgrade ruby-develUpgrade rubyUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-irb | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby23Upgrade ruby22Upgrade ruby20Upgrade ruby24 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Apply Apple macOS Security Update 2018-002 High SierraUpgrade macOS to the latest version | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade ruby-develUpgrade ruby-irbUpgrade rubyUpgrade ruby-tcltkUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade ruby-libsUpgrade ruby-doc | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby1.8Upgrade ruby2.5 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubyUpgrade ruby-tcltkUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade ruby-develUpgrade ruby-doc | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | No solution existsUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubyUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-tcltk | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-doc-riUpgrade yast2-ruby-bindingsUpgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-develUpgrade ruby2.5-docUpgrade libruby2_1-2_1Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade libruby2_5-2_5 | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade libruby2.0Upgrade libruby1.9.1Upgrade ruby2.0Upgrade ruby1.9.1Upgrade libruby2.3Upgrade ruby1.9.3Upgrade ruby2.3 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub