In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
CVSS Details
- CVSS 3.1 Base Score: 3.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-raccUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-power_assertUpgrade rubygem-rssUpgrade rubygem-pg-docUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade ruby-default-gemsUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-rexmlUpgrade rubygem-mysql2-docUpgrade rubygem-test-unit | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-develUpgrade ruby3.2Upgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-docUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-io-console-debuginfo | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade rubygemsUpgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-rexmlUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygem-abrt-docUpgrade rubyUpgrade rubygem-typeprofUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-io-console | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade ruby-default-gemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygems-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade rubygem-minitestUpgrade rubygem-rexmlUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade rubygem-rssUpgrade rubygem-racc-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-rdocUpgrade rubygem-mysql2Upgrade rubyNo solution existsUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-rbs-debuginfo | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade rubygem-raccUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade ruby-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.5-devel | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby3.3Upgrade ruby3.3Upgrade libruby3.0Upgrade ruby2.7 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub