Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygem-abrt-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade rubygem-json | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-mongo-docUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade rubygem-rdocUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debuginfoUpgrade ruby-irbUpgrade rubygem-bundler-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-develUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-bson-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-abrtUpgrade rubygems | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-net-telnetUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-bundler-docUpgrade rubygem-power_assertUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-irb | Jul 2, 2021 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-bson-docUpgrade ruby-develUpgrade rubygem-pgUpgrade ruby-irbUpgrade rubygem-bundler-docUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrtUpgrade rubygem-openssl-debuginfoUpgrade ruby-docUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-mongo-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoNo solution existsUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubyUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade rubygem-minitestUpgrade rubygem-pg-doc | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade ruby-develUpgrade ruby-debugsourceUpgrade rubygem-bsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-pg-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-mysql2 | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.1Upgrade ruby2.5-doc-riUpgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade ruby2.1-develUpgrade ruby2.5-develUpgrade yast2-ruby-bindings | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby2.3Upgrade libruby2.5Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub