In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ruby-develUpgrade rubyUpgrade ruby-docUpgrade ruby-tcltkUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygems-develUpgrade rubygem-rake | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby20Upgrade ruby22Upgrade ruby23 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Apply OS X security update 2018-002 High SierraUpgrade macOS to the latest version | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygemsUpgrade rubyUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade ruby-develUpgrade rubygem-rakeUpgrade ruby-tcltk | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby2.5Upgrade ruby1.9.1Upgrade ruby1.8 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-jsonUpgrade ruby-docUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade ruby-libsUpgrade rubyUpgrade rubygem-psych | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygems-develUpgrade rubygemsUpgrade ruby-libsUpgrade ruby-irbUpgrade ruby-tcltkUpgrade rubygem-minitestNo solution existsUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rake | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade yast2-ruby-bindingsUpgrade ruby2.1-develUpgrade ruby2.5-doc-riUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-docUpgrade ruby2.1 | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby1.9.3Upgrade ruby2.3Upgrade ruby1.9.1Upgrade libruby2.0Upgrade libruby1.9.1Upgrade ruby2.0 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub