In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-json | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby20Upgrade ruby22Upgrade ruby23 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply OS X security update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade ruby-tcltkUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade ruby-irbUpgrade rubyUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-jsonUpgrade ruby-libs | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby2.5Upgrade ruby1.8 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygems-develUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubyUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade ruby-tcltk | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-psychUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-bigdecimalNo solution existsUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade ruby-irbUpgrade ruby-libs | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5-docUpgrade ruby2.1-develUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade libruby2_1-2_1Upgrade ruby2.5-devel-extraUpgrade ruby2.1Upgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade yast2-ruby-bindingsUpgrade ruby-bundled-gems-rpmhelper | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade ruby1.9.1Upgrade libruby2.0Upgrade ruby2.3Upgrade libruby1.9.1Upgrade libruby2.3Upgrade ruby1.9.3Upgrade ruby2.0 | Apr 25, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub