Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade rubygem-pg | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-irbUpgrade rubygem-did_you_meanUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygemsUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade ruby-tcltkUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bigdecimal | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade ruby-develUpgrade ruby-irbUpgrade rubyUpgrade rubygem-bson-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-bson-debuginfoUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-bson-docUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade ruby-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-mongo-docUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade rubygem-rake | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubyUpgrade rubygem-mongo-docUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygemsUpgrade rubygem-mysql2Upgrade rubygem-bundler-docUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade ruby-devel | Jul 2, 2021 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade ruby-irbUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-jsonUpgrade rubygem-mongoNo solution existsUpgrade rubygem-bson-debugsourceUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-irbUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygem-pg-doc | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-bson-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.1Upgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade yast2-ruby-bindingsUpgrade ruby2.1-develUpgrade ruby2.5-devel | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub