Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-abrt-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-jsonUpgrade rubygemsUpgrade rubyUpgrade rubygem-xmlrpcUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade ruby-tcltkUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade ruby-devel | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-mongo-docUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubyUpgrade ruby-debugsourceUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade rubygem-minitestUpgrade rubygem-json-debuginfoUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-net-telnetUpgrade ruby-irbUpgrade rubygemsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsource | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade ruby2.5 | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-xmlrpcUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygem-pg-doc | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubyUpgrade rubygem-bson-debugsourceUpgrade rubygems-develUpgrade rubygem-mysql2-debugsourceUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mongo-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubygem-bundler-docUpgrade rubygem-opensslNo solution existsUpgrade rubygem-mysql2Upgrade rubygem-abrt-docUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mongoUpgrade ruby-libs-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-json-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade ruby2.1-develUpgrade ruby2.5Upgrade libruby2_1-2_1Upgrade ruby2.1Upgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.5-develUpgrade libruby2_5-2_5 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby2.3Upgrade ruby2.5Upgrade libruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub