Search CVE reports

1 – 10 of 104 results

Detailed view

Sort by:

CVE-2023-36617

Medium priority

Some fixes available 7 of 21

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects...

9 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby1.9.1	Not in release	Not in release	Not in release	Not in release
ruby2.0	Not in release	Not in release	Not in release	Not in release
ruby2.3	Not in release	Not in release	Not in release	Not in release
ruby2.5	Not in release	Not in release	Not in release	Fixed
ruby2.7	Not in release	Not in release	Fixed	Not in release
ruby3.0	Not in release	Fixed	Not in release	Not in release
ruby3.1	Not in release	Not in release	Not in release	Not in release
jruby	Needs evaluation	Not in release	Needs evaluation	Needs evaluation
rubygems	Not affected	Needs evaluation	Not in release	Ignored

CVE-2023-28756

Medium priority

Some fixes available 8 of 17

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time...

9 affected packages

ruby3.0, jruby, ruby2.5, ruby2.7, ruby3.1...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby3.0	Not in release	Fixed	Not in release	Not in release
jruby	Needs evaluation	Not in release	Needs evaluation	Needs evaluation
ruby2.5	Not in release	Not in release	Not in release	Fixed
ruby2.7	Not in release	Not in release	Fixed	Not in release
ruby3.1	Not in release	Not in release	Not in release	Not in release
ruby1.9.1	Not in release	Not in release	Not in release	Not in release
ruby2.0	Not in release	Not in release	Not in release	Not in release
ruby2.3	Not in release	Not in release	Not in release	Not in release
rubygems	Not affected	Not affected	Not in release	Not in release

CVE-2023-28755

Medium priority

Some fixes available 8 of 20

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI...

9 affected packages

ruby3.0, jruby, ruby1.9.1, ruby2.0, ruby2.3...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby3.0	Not in release	Fixed	Not in release	Not in release
jruby	Needs evaluation	Not in release	Vulnerable	Vulnerable
ruby1.9.1	Not in release	Not in release	Not in release	Not in release
ruby2.0	Not in release	Not in release	Not in release	Not in release
ruby2.3	Not in release	Not in release	Not in release	Not in release
ruby2.5	Not in release	Not in release	Not in release	Fixed
ruby2.7	Not in release	Not in release	Fixed	Not in release
ruby3.1	Not in release	Not in release	Not in release	Not in release
rubygems	Not affected	Vulnerable	Not in release	Not in release

CVE-2021-33621

Medium priority

Some fixes available 6 of 15

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create...

8 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby1.9.1	—	Not in release	Not in release	Not in release
ruby2.0	—	Not in release	Not in release	Not in release
ruby2.3	—	Not in release	Not in release	Not in release
ruby2.5	—	Not in release	Not in release	Fixed
ruby2.7	—	Not in release	Fixed	Not in release
ruby3.0	Not in release	Fixed	Not in release	Not in release
ruby3.1	Not in release	Not in release	Not in release	Not in release
jruby	Needs evaluation	Not in release	Needs evaluation	Needs evaluation

CVE-2021-32066

Medium priority

Fixed

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to...

5 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby1.9.1	—	Not in release	Not in release	Not in release
ruby2.0	—	Not in release	Not in release	Not in release
ruby2.3	—	Not in release	Not in release	Not in release
ruby2.5	—	Not in release	Not in release	Fixed
ruby2.7	—	—	Fixed	Not in release

CVE-2021-31810

Low priority

Fixed

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially...

5 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby1.9.1	—	Not in release	Not in release	Not in release
ruby2.0	—	Not in release	Not in release	Not in release
ruby2.3	—	Not in release	Not in release	Not in release
ruby2.5	—	Not in release	Not in release	Fixed
ruby2.7	—	—	Fixed	Not in release

CVE-2021-31799

Medium priority

Fixed

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

5 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby1.9.1	—	Not in release	Not in release	Not in release
ruby2.0	—	Not in release	Not in release	Not in release
ruby2.3	—	Not in release	Not in release	Not in release
ruby2.5	—	Not in release	Not in release	Fixed
ruby2.7	—	—	Fixed	Not in release

CVE-2020-25613

Low priority

Fixed

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker...

5 affected packages

ruby2.7, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby2.7	—	—	Fixed	Not in release
ruby1.9.1	—	—	Not in release	Not in release
ruby2.0	—	—	Not in release	Not in release
ruby2.3	—	—	Not in release	Not in release
ruby2.5	—	—	Not in release	Fixed

CVE-2020-10933

Low priority

Some fixes available 2 of 3

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size,...

5 affected packages

ruby2.7, ruby2.5, ruby1.9.1, ruby2.0, ruby2.3

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby2.7	—	—	Fixed	Not in release
ruby2.5	—	—	Not in release	Fixed
ruby1.9.1	—	—	Not in release	Not in release
ruby2.0	—	—	Not in release	Not in release
ruby2.3	—	—	Not in release	Not in release

CVE-2019-8325

Medium priority

Some fixes available 8 of 11

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)

6 affected packages

ruby2.1, jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
ruby2.1	Not in release	Not in release	Not in release	Not in release
jruby	Not affected	—	Not affected	Vulnerable
ruby1.9.1	Not in release	Not in release	Not in release	Not in release
ruby2.0	Not in release	Not in release	Not in release	Not in release
ruby2.3	Not in release	Not in release	Not in release	Not in release
ruby2.5	Not in release	Not in release	Not in release	Fixed

Export to JSON

Results by page: