Search CVE reports

Toggle filters

1 – 7 of 7 results

CVE-2024-27282

Medium priority

Some fixes available 4 of 14

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive...

7 affected packages

ruby2.5, ruby2.7, ruby3.1, ruby3.2, ruby2.3...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
ruby2.5 Not in release Not in release Not in release Vulnerable
ruby2.7 Not in release Not in release Fixed —
ruby3.1 Not in release Not in release Not in release —
ruby3.2 Fixed Not in release Not in release —
ruby2.3 Not in release Not in release Not in release —
ruby3.0 Not in release Fixed Not in release —
jruby Needs evaluation Not in release Needs evaluation Needs evaluation
Show all 7 packages Show less packages

CVE-2024-27281

Medium priority

Some fixes available 6 of 14

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are...

7 affected packages

ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.1...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
ruby2.3 Not in release Not in release Not in release —
ruby2.5 Not in release Not in release Not in release Fixed
ruby2.7 Not in release Not in release Fixed —
ruby3.0 Not in release Fixed Not in release —
ruby3.1 Not in release Not in release Not in release —
jruby Needs evaluation Not in release Needs evaluation Needs evaluation
ruby3.2 Fixed Not in release Not in release Not in release
Show all 7 packages Show less packages

CVE-2024-27280

Medium priority

Some fixes available 3 of 5

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call...

6 affected packages

ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.1, ruby3.2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
ruby2.3 Not in release Not in release Not in release —
ruby2.5 Not in release Not in release Not in release Needs evaluation
ruby2.7 Not in release Not in release Fixed —
ruby3.0 Not in release Fixed Not in release —
ruby3.1 Not in release Not in release Not in release —
ruby3.2 Not affected Not in release Not in release Not in release
Show less packages

CVE-2023-36617

Medium priority

Some fixes available 7 of 21

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects...

9 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
ruby1.9.1 Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Not in release
ruby2.5 Not in release Not in release Not in release Fixed
ruby2.7 Not in release Not in release Fixed Not in release
ruby3.0 Not in release Fixed Not in release Not in release
ruby3.1 Not in release Not in release Not in release Not in release
jruby Needs evaluation Not in release Needs evaluation Needs evaluation
rubygems Not affected Needs evaluation Not in release Ignored
Show all 9 packages Show less packages

CVE-2023-28756

Medium priority

Some fixes available 8 of 17

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time...

9 affected packages

ruby3.0, jruby, ruby2.5, ruby2.7, ruby3.1...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
ruby3.0 Not in release Fixed Not in release Not in release
jruby Needs evaluation Not in release Needs evaluation Needs evaluation
ruby2.5 Not in release Not in release Not in release Fixed
ruby2.7 Not in release Not in release Fixed Not in release
ruby3.1 Not in release Not in release Not in release Not in release
ruby1.9.1 Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Not in release
rubygems Not affected Not affected Not in release Not in release
Show all 9 packages Show less packages

CVE-2023-28755

Medium priority

Some fixes available 8 of 20

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI...

9 affected packages

ruby3.0, jruby, ruby1.9.1, ruby2.0, ruby2.3...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
ruby3.0 Not in release Fixed Not in release Not in release
jruby Needs evaluation Not in release Vulnerable Vulnerable
ruby1.9.1 Not in release Not in release Not in release Not in release
ruby2.0 Not in release Not in release Not in release Not in release
ruby2.3 Not in release Not in release Not in release Not in release
ruby2.5 Not in release Not in release Not in release Fixed
ruby2.7 Not in release Not in release Fixed Not in release
ruby3.1 Not in release Not in release Not in release Not in release
rubygems Not affected Vulnerable Not in release Not in release
Show all 9 packages Show less packages

CVE-2021-33621

Medium priority

Some fixes available 6 of 15

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create...

8 affected packages

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
ruby1.9.1 — Not in release Not in release Not in release
ruby2.0 — Not in release Not in release Not in release
ruby2.3 — Not in release Not in release Not in release
ruby2.5 — Not in release Not in release Fixed
ruby2.7 — Not in release Fixed Not in release
ruby3.0 Not in release Fixed Not in release Not in release
ruby3.1 Not in release Not in release Not in release Not in release
jruby Needs evaluation Not in release Needs evaluation Needs evaluation
Show all 8 packages Show less packages