Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade rubygem-pg | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-xmlrpcUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygem-minitestUpgrade ruby-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimalUpgrade ruby-tcltk | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-pg-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-irbUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade ruby-libs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-bson-debugsourceUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-minitestUpgrade ruby-develUpgrade ruby-irbUpgrade rubyUpgrade rubygem-bundler-docUpgrade ruby-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-rdocUpgrade rubygem-mongo-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-devel | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-xmlrpcUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-bundler-docUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-net-telnetUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubyUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-abrt | Jul 2, 2021 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade rubygemsUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade ruby-irbUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-mongoUpgrade ruby-libsNo solution existsUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bson-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-bsonUpgrade rubygem-minitestUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubyUpgrade rubygem-opensslUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade ruby2.1-develUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade libruby2_1-2_1Upgrade ruby2.5-doc-riUpgrade ruby2.1Upgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby2.5-devel-extra | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub