Search CVE reports
51 – 60 of 86 results
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a...
8 affected packages
jruby, libgems-ruby, ruby1.8, ruby1.9.1, ruby2.1...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| jruby | — | — | — | — |
| libgems-ruby | — | — | — | — |
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.1 | — | — | — | — |
| ruby2.2 | — | — | — | — |
| ruby2.3 | — | — | — | — |
| rubygems | — | — | — | — |
Some fixes available 2 of 11
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors...
6 affected packages
ruby1.8, ruby1.9.1, ruby2.0, ruby2.1, ruby2.2, ruby2.3
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.0 | — | — | — | — |
| ruby2.1 | — | — | — | — |
| ruby2.2 | — | — | — | — |
| ruby2.3 | — | — | — | — |
Some fixes available 8 of 12
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document...
4 affected packages
ruby1.8, ruby1.9.1, ruby2.0, ruby2.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.0 | — | — | — | — |
| ruby2.1 | — | — | — | — |
Some fixes available 8 of 13
The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion...
5 affected packages
ruby1.8, ruby1.9, ruby1.9.1, ruby2.0, ruby2.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.0 | — | — | — | — |
| ruby2.1 | — | — | — | — |
The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.
7 affected packages
ruby1.8, ruby1.9, ruby1.9.1, ruby2.0, ruby2.1...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.0 | — | — | — | — |
| ruby2.1 | — | — | — | — |
| ruby2.2 | — | — | — | — |
| ruby2.3 | — | — | — | — |
Some fixes available 7 of 12
Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault)...
5 affected packages
ruby1.8, ruby1.9, ruby1.9.1, ruby2.0, ruby2.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.0 | — | — | — | — |
| ruby2.1 | — | — | — | — |
The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string.
4 affected packages
ruby1.8, ruby1.9.1, ruby2.0, ruby2.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.0 | — | — | — | — |
| ruby2.1 | — | — | — | — |
The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature...
4 affected packages
ruby2.0, ruby1.8, ruby1.9, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby2.0 | — | — | — | — |
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0...
3 affected packages
jruby, ruby1.9.1, rubygems
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| jruby | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| rubygems | — | — | — | — |
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0...
3 affected packages
jruby, ruby1.9.1, rubygems
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| jruby | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| rubygems | — | — | — | — |