Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-abrt-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygems-develUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-develUpgrade ruby-tcltkUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-doc | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mongoUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-irbUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubyUpgrade rubygem-bundler-docUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubygem-test-unitUpgrade rubygem-openssl-debuginfoUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-opensslUpgrade rubygem-psych-debuginfoUpgrade rubygem-did_you_mean | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade ruby2.5 | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-rdocUpgrade rubygem-bundlerUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade rubyUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygems-develUpgrade rubygem-net-telnet | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | No solution existsUpgrade ruby-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygem-openssl-debuginfoUpgrade rubygem-minitestUpgrade rubygem-xmlrpcUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bsonUpgrade rubygem-mongoUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade ruby-irbUpgrade rubygem-bson-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pgUpgrade rubygem-mysql2-debugsource | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5Upgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1Upgrade ruby2.1-stdlib | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.3Upgrade ruby2.5Upgrade libruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub