In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
CVSS Details
- CVSS 3.1 Base Score: 3.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-rbsUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-rssUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-raccUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-rakeUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygemsUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-irbUpgrade rubygems-develUpgrade ruby-doc | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-libsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2Upgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygemsUpgrade ruby3.2-debugsourceUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rbs | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade rubygemsUpgrade ruby2.7 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade rubygem-rssUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade rubygem-power_assertUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubyUpgrade ruby-libsUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-rexmlUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-rdoc | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade ruby-bundled-gems-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-irbUpgrade rubyUpgrade rubygem-psychNo solution existsUpgrade rubygem-rdocUpgrade rubygem-bundlerUpgrade rubygem-racc-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-rbsUpgrade ruby-libs-debuginfoUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-rexmlUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-raccUpgrade rubygem-io-consoleUpgrade rubygem-typeprofUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debugsource | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-rbsUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-racc-debuginfoUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-rbs-debuginfoUpgrade rubygem-raccUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-docUpgrade ruby2.5-doc-ri | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby3.0Upgrade ruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby3.3Upgrade ruby2.7Upgrade libruby3.0 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub