The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade rubygem-pg-docUpgrade rubygem-mongo-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade ruby-tcltkUpgrade rubygem-bigdecimalUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade rubyUpgrade rubygem-minitestUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-opensslUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-did_you_meanUpgrade rubygem-power_assert | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-rdocUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade ruby-irbUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade rubygem-net-telnetUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade ruby-libsUpgrade rubygem-pg-debugsourceUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-psych | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Mar 24, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-bson-docUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-bundler-docUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade ruby-docUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-pg | Jul 2, 2021 | Nov 26, 2019 |
| Redhat_linux | — | Upgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bundler-docUpgrade ruby-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygemsUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-jsonNo solution existsUpgrade rubygem-mongoUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-abrt-docUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade rubygem-mysql2-debugsourceUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygem-pg-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-bson-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-mysql2-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade ruby2.1Upgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade ruby2.1-devel | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby2.3Upgrade libruby2.5Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub