An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-mongo-doc | May 4, 2022 | May 4, 2020 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | May 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade ruby-libsUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade rubygem-minitestUpgrade rubygem-power_assert | Sep 28, 2023 | May 4, 2020 |
| Centos_linux | — | Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-mongoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-bson-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-irbUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-json-debuginfoUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-bundler-doc | Jun 30, 2021 | May 4, 2020 |
| Debian | — | Upgrade ruby2.7 | Jul 10, 2020 | May 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | May 27, 2020 | May 4, 2020 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.8-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.6-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | May 4, 2020 |
| Oracle_linux | — | Upgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygemsUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubyUpgrade ruby-develUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade rubygem-mysql2 | Jul 2, 2021 | Mar 31, 2020 |
| Redhat_linux | — | Upgrade rubygem-abrt-docUpgrade ruby-debugsourceUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-rdocUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygem-bson-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bsonUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade rubygem-openssl-debuginfo | Jun 30, 2021 | May 4, 2020 |
| Rocky_linux | — | Upgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubyUpgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-openssl | May 5, 2022 | May 4, 2020 |
| Suse | — | Upgrade ruby2.5-devel-extraUpgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.5-doc | May 7, 2020 | May 4, 2020 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.3Upgrade ruby2.7Upgrade ruby2.5Upgrade libruby2.7Upgrade libruby2.5 | Mar 19, 2021 | May 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub