In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ruby-tcltkUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubyUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-irb | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby22Upgrade ruby23Upgrade ruby20Upgrade ruby24 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply OS X security update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-libsUpgrade ruby-irbUpgrade ruby-tcltkUpgrade rubygem-io-console | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby1.8Upgrade ruby2.5 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-jsonUpgrade ruby-tcltkUpgrade ruby-docUpgrade rubyUpgrade rubygemsUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-io-console | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade ruby-docUpgrade rubyNo solution existsUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade ruby-libs | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.1-develUpgrade yast2-ruby-bindingsUpgrade ruby2.5-doc-riUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-develUpgrade ruby2.5-docUpgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.5-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.1 | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade libruby2.0Upgrade ruby2.0Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade libruby2.3Upgrade ruby2.3Upgrade ruby1.9.3 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub