Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-bson | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-xmlrpcUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade ruby-develUpgrade ruby-irbUpgrade ruby-docUpgrade ruby-libsUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade rubygem-bundler | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade ruby-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade ruby-docUpgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade ruby-debuginfoUpgrade rubyUpgrade ruby-debugsourceUpgrade rubygem-bundler-docUpgrade rubygem-openssl | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade ruby2.5 | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-irbUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-json | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-power_assertUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debugsourceUpgrade ruby-irbUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubygem-rakeUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debugsourceUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubyUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-mysql2No solution existsUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-bundler-doc | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-opensslUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psych | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.1-develUpgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1Upgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.1Upgrade ruby2.5-docUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlib | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby2.3Upgrade libruby2.5Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub