In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
CVSS Details
- CVSS 3.1 Base Score: 3.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade rubygem-raccUpgrade rubygem-mysql2Upgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-rbsUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-rakeUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-power_assert | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2Upgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-libs-debuginfo | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade rubygemsUpgrade ruby2.7Upgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-rssUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubygem-rexmlUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygems-devel | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-rssUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-rexmlUpgrade rubyUpgrade rubygem-irbNo solution existsUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gemsUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-abrtUpgrade rubygem-rbsUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-rbs-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-racc-debuginfoUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygem-raccUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-mysql2-debugsourceUpgrade ruby-default-gemsUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-typeprof | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-raccUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-rbsUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-devel-extraUpgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-doc-ri | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade ruby2.7Upgrade libruby3.3Upgrade ruby3.3Upgrade libruby3.0Upgrade ruby3.2Upgrade libruby2.7Upgrade ruby3.0Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub