Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

Search CVE reports


Toggle filters

1 – 10 of 104 results


CVE-2023-36617

Medium priority

Some fixes available 7 of 20

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects...

9 affected packages

jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
jruby Needs evaluation Not in release Needs evaluation Needs evaluation Needs evaluation
ruby1.9.1 Not in release Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Not in release Fixed
ruby2.5 Not in release Not in release Not in release Fixed Not in release
ruby2.7 Not in release Not in release Fixed Not in release Not in release
ruby3.0 Not in release Fixed Not in release Not in release Not in release
ruby3.1 Not in release Not in release Not in release Not in release Not in release
rubygems Not affected Needs evaluation Not in release Ignored Ignored
Show all 9 packages Show less packages

CVE-2023-28756

Medium priority

Some fixes available 8 of 16

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time...

9 affected packages

jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
jruby Needs evaluation Not in release Needs evaluation Needs evaluation Needs evaluation
ruby1.9.1 Not in release Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Not in release Fixed
ruby2.5 Not in release Not in release Not in release Fixed Ignored
ruby2.7 Not in release Not in release Fixed Not in release Ignored
ruby3.0 Not in release Fixed Not in release Not in release Not in release
ruby3.1 Not in release Not in release Not in release Not in release Ignored
rubygems Not affected Not affected Not in release Not in release Ignored
Show all 9 packages Show less packages

CVE-2023-28755

Medium priority

Some fixes available 8 of 19

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI...

9 affected packages

jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
jruby Needs evaluation Not in release Vulnerable Vulnerable Vulnerable
ruby1.9.1 Not in release Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Not in release Fixed
ruby2.5 Not in release Not in release Not in release Fixed Ignored
ruby2.7 Not in release Not in release Fixed Not in release Ignored
ruby3.0 Not in release Fixed Not in release Not in release Not in release
ruby3.1 Not in release Not in release Not in release Not in release Ignored
rubygems Not affected Vulnerable Not in release Not in release Ignored
Show all 9 packages Show less packages

CVE-2021-33621

Medium priority

Some fixes available 6 of 14

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create...

8 affected packages

jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
jruby Needs evaluation Not in release Needs evaluation Needs evaluation Needs evaluation
ruby1.9.1 Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Fixed
ruby2.5 Not in release Not in release Fixed Not in release
ruby2.7 Not in release Fixed Not in release Not in release
ruby3.0 Not in release Fixed Not in release Not in release Not in release
ruby3.1 Not in release Not in release Not in release Not in release Not in release
Show all 8 packages Show less packages

CVE-2016-2338

Medium priority
Not affected

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length....

6 affected packages

ruby-psych, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
ruby-psych Not affected Not in release
ruby1.9.1 Not in release Not in release
ruby2.0 Not in release Not in release
ruby2.3 Not in release Not affected
ruby2.5 Not affected Not in release
ruby2.7 Not in release Not in release
Show less packages

CVE-2021-32066

Medium priority
Fixed

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to...

5 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
ruby1.9.1 Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Fixed
ruby2.5 Not in release Not in release Fixed Not in release
ruby2.7 Fixed Not in release Not in release
Show less packages

CVE-2021-31799

Medium priority
Fixed

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

5 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
ruby1.9.1 Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Fixed
ruby2.5 Not in release Not in release Fixed Not in release
ruby2.7 Fixed Not in release Not in release
Show less packages

CVE-2021-31810

Low priority
Fixed

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially...

5 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
ruby1.9.1 Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Fixed
ruby2.5 Not in release Not in release Fixed Not in release
ruby2.7 Fixed Not in release Not in release
Show less packages

CVE-2020-25613

Low priority
Fixed

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker...

5 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
ruby1.9.1 Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release
ruby2.3 Not in release Not in release Fixed
ruby2.5 Not in release Fixed Not in release
ruby2.7 Fixed Not in release Not in release
Show less packages

CVE-2020-10933

Low priority

Some fixes available 2 of 3

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size,...

5 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
ruby1.9.1 Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not affected
ruby2.5 Not in release Fixed Not in release
ruby2.7 Fixed Not in release Not in release
Show less packages