In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-rdoc | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby23Upgrade ruby22Upgrade ruby20Upgrade ruby24 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Apply OS X security update 2018-002 High SierraUpgrade macOS to the latest version | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade rubyUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-minitest | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.8Upgrade ruby2.5Upgrade ruby1.9.1 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubyUpgrade rubygemsUpgrade ruby-tcltkUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-json | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade ruby-develNo solution existsUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade ruby-libsUpgrade ruby-irbUpgrade rubyUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-minitest | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.1Upgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5Upgrade ruby2.5-develUpgrade libruby2_1-2_1Upgrade ruby2.5-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.1-develUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade ruby1.9.1Upgrade ruby2.3Upgrade libruby2.0Upgrade libruby2.3Upgrade libruby1.9.1Upgrade ruby2.0Upgrade ruby1.9.3 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub