An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-abrt-docUpgrade rubygem-mongo-docUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-mysql2-doc | May 4, 2022 | May 4, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | May 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-docUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-openssl | Sep 28, 2023 | May 4, 2020 |
| Centos_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-bundlerUpgrade rubygem-bigdecimalUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-bsonUpgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mongo-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-psych-debuginfoUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mongoUpgrade ruby-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfo | Jun 30, 2021 | May 4, 2020 |
| Debian | — | Upgrade ruby2.7 | Jul 10, 2020 | May 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | May 27, 2020 | May 4, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | May 4, 2020 |
| Oracle_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade ruby-irbUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-mongo-doc | Jul 2, 2021 | Mar 31, 2020 |
| Redhat_linux | — | Upgrade ruby-libs-debuginfoUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubyUpgrade ruby-develUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-rakeUpgrade rubygem-opensslUpgrade rubygem-openssl-debuginfoUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-bundler-docUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygemsUpgrade rubygem-bson-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-mysql2-debugsource | Jun 30, 2021 | May 4, 2020 |
| Rocky_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-pg-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubyUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-opensslUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfo | May 5, 2022 | May 4, 2020 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.5-doc | May 7, 2020 | May 4, 2020 |
| Ubuntu | — | Upgrade ruby2.5Upgrade ruby2.7Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.5Upgrade libruby2.7 | Mar 19, 2021 | May 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub