In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
CVSS Details
- CVSS 3.1 Base Score: 3.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-abrtUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubyUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-pgUpgrade ruby-docUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade ruby-devel | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2Upgrade ruby3.2-develUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-docUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-default-gemsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-json | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade rubygemsUpgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-develUpgrade rubygem-pgUpgrade rubygems-develUpgrade rubygem-rexmlUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-power_assertUpgrade ruby-bundled-gemsUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade rubygem-abrt-docUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-typeprofUpgrade rubygem-psych | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade ruby-default-gemsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-typeprofUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-minitestUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rssUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-racc-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade rubygem-rbs-debuginfoNo solution existsUpgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade ruby-debuginfoUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade ruby-libs-debuginfoUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-irbUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade ruby-debugsource | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-psychUpgrade rubygem-rbsUpgrade rubygem-racc-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygem-rbs-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-raccUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade ruby2.7Upgrade libruby3.3Upgrade libruby3.0Upgrade ruby3.3Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby3.0Upgrade libruby3.2 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub