An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade rubygem-abrt-docUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-abrt | May 4, 2022 | May 4, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | May 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubyUpgrade ruby-libs | Sep 28, 2023 | May 4, 2020 |
| Centos_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-docUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade ruby-irbUpgrade rubygem-irbUpgrade rubygem-net-telnetUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-abrt-docUpgrade rubygem-psych-debuginfoUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade ruby-libs-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade rubygem-did_you_mean | Jun 30, 2021 | May 4, 2020 |
| Debian | — | Upgrade ruby2.7 | Jul 10, 2020 | May 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | May 27, 2020 | May 4, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | May 4, 2020 |
| Oracle_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade rubyUpgrade rubygemsUpgrade rubygem-bsonUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade rubygem-bundler-docUpgrade rubygem-net-telnetUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-abrt-docUpgrade rubygem-xmlrpcUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby-libsUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-bson-doc | Jul 2, 2021 | Mar 31, 2020 |
| Redhat_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubygem-rdocUpgrade ruby-irbUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-mysql2-debugsourceUpgrade rubygemsUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade rubygem-psych-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrtUpgrade rubygem-rakeUpgrade rubygem-bundler | Jun 30, 2021 | May 4, 2020 |
| Rocky_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-bsonUpgrade rubygem-json-debuginfoUpgrade ruby-libs | May 5, 2022 | May 4, 2020 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-develUpgrade ruby2.5-devel-extra | May 7, 2020 | May 4, 2020 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.7Upgrade ruby2.5Upgrade libruby2.3 | Mar 19, 2021 | May 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub