An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-abrt | May 4, 2022 | May 4, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | May 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade ruby-docUpgrade rubygemsUpgrade ruby-libsUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade ruby-debuginfo | Sep 28, 2023 | May 4, 2020 |
| Centos_linux | — | Upgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade ruby-irbUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade ruby-libsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-bson-debuginfoUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade ruby-docUpgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade ruby-libs-debuginfoUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygem-json-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-bsonUpgrade rubygem-bundlerUpgrade ruby-debuginfo | Jun 30, 2021 | May 4, 2020 |
| Debian | — | Upgrade ruby2.7 | Jul 10, 2020 | May 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | May 27, 2020 | May 4, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | May 4, 2020 |
| Oracle_linux | — | Upgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-bundler-docUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygemsUpgrade rubygem-bsonUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-bson-docUpgrade rubygem-did_you_mean | Jul 2, 2021 | Mar 31, 2020 |
| Redhat_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdocUpgrade rubygem-mysql2-debugsourceUpgrade ruby-irbUpgrade rubygem-net-telnetUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-jsonUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade ruby-libs | Jun 30, 2021 | May 4, 2020 |
| Rocky_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade ruby-develUpgrade rubygem-openssl-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade ruby-libsUpgrade rubygem-opensslUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfo | May 5, 2022 | May 4, 2020 |
| Suse | — | Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5-devel-extra | May 7, 2020 | May 4, 2020 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby2.5Upgrade libruby2.3Upgrade ruby2.5Upgrade ruby2.3Upgrade ruby2.7 | Mar 19, 2021 | May 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub