Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade rubygem-pg | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-opensslUpgrade rubygem-irbUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-xmlrpcUpgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-power_assertUpgrade ruby-irbUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-net-telnet | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-minitestUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-mongoUpgrade ruby-libsUpgrade rubygem-net-telnetUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-bundlerUpgrade rubygemsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-bson-debuginfoUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-xmlrpcUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-mysql2-doc | Jul 2, 2021 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade rubygem-pgUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-xmlrpcUpgrade ruby-libs-debuginfoUpgrade rubygem-did_you_meanUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rdocUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoNo solution existsUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade rubygem-irbUpgrade rubygem-mongo-docUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-jsonUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygem-io-console | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubyUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsource | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.1-develUpgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade libruby2_1-2_1Upgrade ruby2.5-doc | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.5Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.3 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub