Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-mongo | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubyUpgrade rubygem-rdocUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-net-telnetUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade ruby-tcltk | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-minitestUpgrade rubygem-bson-debugsourceUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-docUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-bson | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-bundler-doc | Jul 2, 2021 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade rubygem-pg-debuginfoUpgrade rubygem-pg-debugsourceNo solution existsUpgrade rubygem-bundlerUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongoUpgrade rubygem-mongo-docUpgrade rubyUpgrade rubygem-bson-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-net-telnetUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-psych-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade ruby-libs-debuginfoUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade rubygem-io-console-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade libruby2_1-2_1Upgrade ruby2.1-develUpgrade yast2-ruby-bindingsUpgrade ruby2.5-devel | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub