Search CVE reports
31 – 35 of 35 results
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially...
5 affected packages
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5, ruby2.7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.9.1 | — | Not in release | Not in release | Not in release |
| ruby2.0 | — | Not in release | Not in release | Not in release |
| ruby2.3 | — | Not in release | Not in release | Not in release |
| ruby2.5 | — | Not in release | Not in release | Fixed |
| ruby2.7 | — | — | Fixed | Not in release |
Some fixes available 6 of 9
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
4 affected packages
ruby-rexml, ruby2.3, ruby2.5, ruby2.7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby-rexml | — | Not in release | Not in release | Not in release |
| ruby2.3 | — | Not in release | Not in release | Not in release |
| ruby2.5 | — | Not in release | Not in release | Fixed |
| ruby2.7 | — | — | Fixed | Not in release |
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker...
5 affected packages
ruby2.7, ruby1.9.1, ruby2.0, ruby2.3, ruby2.5
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby2.7 | — | — | Fixed | Not in release |
| ruby1.9.1 | — | — | Not in release | Not in release |
| ruby2.0 | — | — | Not in release | Not in release |
| ruby2.3 | — | — | Not in release | Not in release |
| ruby2.5 | — | — | Not in release | Fixed |
Some fixes available 2 of 3
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size,...
5 affected packages
ruby2.7, ruby2.5, ruby1.9.1, ruby2.0, ruby2.3
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby2.7 | — | — | Fixed | Not in release |
| ruby2.5 | — | — | Not in release | Fixed |
| ruby1.9.1 | — | — | Not in release | Not in release |
| ruby2.0 | — | — | Not in release | Not in release |
| ruby2.3 | — | — | Not in release | Not in release |
Some fixes available 2 of 7
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor...
5 affected packages
ruby-json, ruby2.1, ruby2.3, ruby2.5, ruby2.7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby-json | Not affected | Not affected | Not affected | Needs evaluation |
| ruby2.1 | Not in release | Not in release | Not in release | Not in release |
| ruby2.3 | Not in release | Not in release | Not in release | Not in release |
| ruby2.5 | Not in release | Not in release | Not in release | Fixed |
| ruby2.7 | — | — | Not affected | Not in release |