In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
CVSS Details
- CVSS 3.1 Base Score: 3.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygems-develUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade rubygem-rdocUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-rakeUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-raccUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-rbs | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2Upgrade ruby3.2-develUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-debuginfoUpgrade ruby3.2-bundled-gems | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade rubygemsUpgrade ruby2.7 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade ruby-default-gemsUpgrade rubygem-raccUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-rssUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-rbsUpgrade rubygem-power_assert | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-rakeUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-raccUpgrade rubygem-pg-docUpgrade rubygem-typeprofUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-power_assertUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade rubygem-irbUpgrade ruby-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubyNo solution existsUpgrade rubygem-rssUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-racc-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade ruby-debugsourceUpgrade rubygem-abrtUpgrade rubygem-rexmlUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-libs | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade ruby-bundled-gemsUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-pg | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.0Upgrade libruby2.7Upgrade ruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade ruby3.3Upgrade libruby3.3Upgrade libruby3.0 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub