An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-abrt | May 4, 2022 | May 4, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | May 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygemsUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubyUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-power_assert | Sep 28, 2023 | May 4, 2020 |
| Centos_linux | — | Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-io-consoleUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rakeUpgrade rubyUpgrade ruby-debugsourceUpgrade rubygem-net-telnetUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-mongo-docUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-abrt-doc | Jun 30, 2021 | May 4, 2020 |
| Debian | — | Upgrade ruby2.7 | Jul 10, 2020 | May 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | May 27, 2020 | May 4, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | May 4, 2020 |
| Oracle_linux | — | Upgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygemsUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-xmlrpcUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-abrt | Jul 2, 2021 | Mar 31, 2020 |
| Redhat_linux | — | Upgrade rubygem-irbUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mongo-docUpgrade rubygem-openssl-debuginfoUpgrade rubyUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bsonUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mongoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade rubygemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade ruby-debugsourceUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade ruby-libs-debuginfoUpgrade rubygem-power_assertUpgrade ruby-irbUpgrade rubygem-rdocUpgrade rubygem-bson-debuginfo | Jun 30, 2021 | May 4, 2020 |
| Rocky_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-openssl-debuginfoUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bson | May 5, 2022 | May 4, 2020 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.5-devel | May 7, 2020 | May 4, 2020 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby2.5Upgrade ruby2.7Upgrade ruby2.3Upgrade libruby2.7Upgrade libruby2.5 | Mar 19, 2021 | May 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub