Search CVE reports
1 – 10 of 86 results
CVE-2023-36617
Medium prioritySome fixes available 7 of 20
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects...
9 affected packages
jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| jruby | Needs evaluation | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| ruby1.9.1 | Not in release | Not in release | Not in release | Not in release | Not in release |
| ruby2.0 | Not in release | Not in release | Not in release | Not in release | Not in release |
| ruby2.3 | Not in release | Not in release | Not in release | Not in release | Fixed |
| ruby2.5 | Not in release | Not in release | Not in release | Fixed | Not in release |
| ruby2.7 | Not in release | Not in release | Fixed | Not in release | Not in release |
| ruby3.0 | Not in release | Fixed | Not in release | Not in release | Not in release |
| ruby3.1 | Not in release | Not in release | Not in release | Not in release | Not in release |
| rubygems | Not affected | Needs evaluation | Not in release | Ignored | Ignored |
CVE-2023-28756
Medium prioritySome fixes available 8 of 16
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time...
9 affected packages
jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| jruby | Needs evaluation | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| ruby1.9.1 | Not in release | Not in release | Not in release | Not in release | Not in release |
| ruby2.0 | Not in release | Not in release | Not in release | Not in release | Not in release |
| ruby2.3 | Not in release | Not in release | Not in release | Not in release | Fixed |
| ruby2.5 | Not in release | Not in release | Not in release | Fixed | Ignored |
| ruby2.7 | Not in release | Not in release | Fixed | Not in release | Ignored |
| ruby3.0 | Not in release | Fixed | Not in release | Not in release | Not in release |
| ruby3.1 | Not in release | Not in release | Not in release | Not in release | Ignored |
| rubygems | Not affected | Not affected | Not in release | Not in release | Ignored |
CVE-2023-28755
Medium prioritySome fixes available 8 of 19
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI...
9 affected packages
jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| jruby | Needs evaluation | Not in release | Vulnerable | Vulnerable | Vulnerable |
| ruby1.9.1 | Not in release | Not in release | Not in release | Not in release | Not in release |
| ruby2.0 | Not in release | Not in release | Not in release | Not in release | Not in release |
| ruby2.3 | Not in release | Not in release | Not in release | Not in release | Fixed |
| ruby2.5 | Not in release | Not in release | Not in release | Fixed | Ignored |
| ruby2.7 | Not in release | Not in release | Fixed | Not in release | Ignored |
| ruby3.0 | Not in release | Fixed | Not in release | Not in release | Not in release |
| ruby3.1 | Not in release | Not in release | Not in release | Not in release | Ignored |
| rubygems | Not affected | Vulnerable | Not in release | Not in release | Ignored |
CVE-2021-33621
Medium prioritySome fixes available 6 of 14
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create...
8 affected packages
jruby, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| jruby | Needs evaluation | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| ruby1.9.1 | — | Not in release | Not in release | Not in release | Not in release |
| ruby2.0 | — | Not in release | Not in release | Not in release | Not in release |
| ruby2.3 | — | Not in release | Not in release | Not in release | Fixed |
| ruby2.5 | — | Not in release | Not in release | Fixed | Not in release |
| ruby2.7 | — | Not in release | Fixed | Not in release | Not in release |
| ruby3.0 | Not in release | Fixed | Not in release | Not in release | Not in release |
| ruby3.1 | Not in release | Not in release | Not in release | Not in release | Not in release |
CVE-2016-2338
Medium priorityAn exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length....
6 affected packages
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7, ruby-psych
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| ruby1.9.1 | — | — | — | Not in release | Not in release |
| ruby2.0 | — | — | — | Not in release | Not in release |
| ruby2.3 | — | — | — | Not in release | Not affected |
| ruby2.5 | — | — | — | Not affected | Not in release |
| ruby2.7 | — | — | — | Not in release | Not in release |
| ruby-psych | — | — | — | Not affected | Not in release |
CVE-2021-32066
Medium priorityAn issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to...
5 affected packages
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| ruby1.9.1 | — | Not in release | Not in release | Not in release | Not in release |
| ruby2.0 | — | Not in release | Not in release | Not in release | Not in release |
| ruby2.3 | — | Not in release | Not in release | Not in release | Fixed |
| ruby2.5 | — | Not in release | Not in release | Fixed | Not in release |
| ruby2.7 | — | — | Fixed | Not in release | Not in release |
CVE-2021-31799
Medium priorityIn RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
5 affected packages
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| ruby1.9.1 | — | Not in release | Not in release | Not in release | Not in release |
| ruby2.0 | — | Not in release | Not in release | Not in release | Not in release |
| ruby2.3 | — | Not in release | Not in release | Not in release | Fixed |
| ruby2.5 | — | Not in release | Not in release | Fixed | Not in release |
| ruby2.7 | — | — | Fixed | Not in release | Not in release |
CVE-2021-31810
Low priorityAn issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially...
5 affected packages
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| ruby1.9.1 | — | Not in release | Not in release | Not in release | Not in release |
| ruby2.0 | — | Not in release | Not in release | Not in release | Not in release |
| ruby2.3 | — | Not in release | Not in release | Not in release | Fixed |
| ruby2.5 | — | Not in release | Not in release | Fixed | Not in release |
| ruby2.7 | — | — | Fixed | Not in release | Not in release |
CVE-2020-25613
Low priorityAn issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker...
5 affected packages
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| ruby1.9.1 | — | — | Not in release | Not in release | Not in release |
| ruby2.0 | — | — | Not in release | Not in release | Not in release |
| ruby2.3 | — | — | Not in release | Not in release | Fixed |
| ruby2.5 | — | — | Not in release | Fixed | Not in release |
| ruby2.7 | — | — | Fixed | Not in release | Not in release |
CVE-2020-10933
Low prioritySome fixes available 2 of 3
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size,...
5 affected packages
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| ruby1.9.1 | — | — | Not in release | Not in release | Not in release |
| ruby2.0 | — | — | Not in release | Not in release | Not in release |
| ruby2.3 | — | — | Not in release | Not in release | Not affected |
| ruby2.5 | — | — | Not in release | Fixed | Not in release |
| ruby2.7 | — | — | Fixed | Not in release | Not in release |