Search CVE reports
11 – 20 of 78 results
Some fixes available 6 of 12
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully",...
7 affected packages
ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby2.5 | Not in release | Not in release | Not in release | — | Fixed |
| ruby2.7 | Not in release | Not in release | Not in release | Fixed | — |
| ruby3.0 | Not in release | Not in release | Fixed | — | — |
| ruby3.2 | Not in release | Fixed | Not in release | — | — |
| ruby3.3 | Fixed | Not in release | Not in release | — | — |
| jruby | Vulnerable | Vulnerable | Not in release | Vulnerable | Vulnerable |
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses...
7 affected packages
ruby2.7, ruby3.0, ruby3.2, ruby3.3, jruby...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ruby2.7 | Not in release | Not in release | Not in release | Not affected | — |
| ruby3.0 | Not in release | Not in release | Not affected | — | — |
| ruby3.2 | Not in release | Not affected | Not in release | — | — |
| ruby3.3 | Not affected | Not in release | Not in release | — | — |
| jruby | Not affected | Not affected | Not in release | Not affected | Not affected |
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby2.5 | Not in release | Not in release | Not in release | — | Not affected |
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is...
7 affected packages
ruby3.3, jruby, ruby2.3, ruby2.5, ruby2.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ruby3.3 | Needs evaluation | Not in release | Not in release | — | — |
| jruby | Needs evaluation | Needs evaluation | Not in release | Needs evaluation | Needs evaluation |
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby2.5 | Not in release | Not in release | Not in release | — | Needs evaluation |
| ruby2.7 | Not in release | Not in release | Not in release | Needs evaluation | — |
| ruby3.0 | Not in release | Not in release | Needs evaluation | — | — |
| ruby3.2 | Not in release | Needs evaluation | Not in release | — | — |
Some fixes available 1 of 14
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function...
7 affected packages
ruby2.3, ruby3.3, jruby, ruby2.5, ruby2.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby3.3 | Needs evaluation | Not in release | Not in release | — | — |
| jruby | Needs evaluation | Needs evaluation | Not in release | Needs evaluation | Needs evaluation |
| ruby2.5 | Not in release | Not in release | Not in release | — | Needs evaluation |
| ruby2.7 | Not in release | Not in release | Not in release | Needs evaluation | — |
| ruby3.0 | Not in release | Not in release | Needs evaluation | — | — |
| ruby3.2 | Not in release | Needs evaluation | Not in release | — | — |
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial...
7 affected packages
ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.2...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby2.5 | Not in release | Not in release | Not in release | — | Vulnerable |
| ruby2.7 | Not in release | Not in release | Not in release | Vulnerable | — |
| ruby3.0 | Not in release | Not in release | Vulnerable | — | — |
| ruby3.2 | Not in release | Vulnerable | Not in release | — | — |
| ruby3.3 | Vulnerable | Not in release | Not in release | — | — |
| jruby | Vulnerable | Vulnerable | Not in release | Vulnerable | Vulnerable |
Some fixes available 6 of 9
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator...
7 affected packages
jruby, ruby2.3, ruby2.5, ruby2.7, ruby3.0...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| jruby | Not affected | Not affected | Not in release | Not affected | Not affected |
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby2.5 | Not in release | Not in release | Not in release | — | Fixed |
| ruby2.7 | Not in release | Not in release | Not in release | Fixed | — |
| ruby3.0 | Not in release | Not in release | Fixed | — | — |
| ruby3.2 | Not in release | Fixed | Not in release | — | — |
| ruby3.3 | Vulnerable | Not in release | Not in release | — | — |
REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities....
7 affected packages
ruby3.3, jruby, ruby2.3, ruby2.5, ruby2.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ruby3.3 | Vulnerable | Not in release | Not in release | — | — |
| jruby | Not affected | Not affected | Not in release | Not affected | Not affected |
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby2.5 | Not in release | Not in release | Not in release | — | Vulnerable |
| ruby2.7 | Not in release | Not in release | Not in release | Vulnerable | — |
| ruby3.0 | Not in release | Not in release | Vulnerable | — | — |
| ruby3.2 | Not in release | Vulnerable | Not in release | — | — |
Some fixes available 10 of 19
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet...
8 affected packages
jruby, ruby2.3, ruby2.5, ruby2.7, ruby3.0...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| jruby | Needs evaluation | Needs evaluation | Not in release | Needs evaluation | Needs evaluation |
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby2.5 | Not in release | Not in release | Not in release | — | Fixed |
| ruby2.7 | Not in release | Not in release | Not in release | Fixed | — |
| ruby3.0 | Not in release | Not in release | Fixed | — | — |
| ruby3.2 | Not in release | Fixed | Not in release | — | — |
| ruby3.3 | Fixed | Not in release | Not in release | — | — |
| rubygems | Fixed | Not affected | Not affected | — | — |
Some fixes available 8 of 13
Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is...
5 affected packages
jruby, ruby-webrick, ruby2.3, ruby2.5, ruby2.7
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| jruby | Not affected | Not affected | Not in release | Vulnerable | Vulnerable |
| ruby-webrick | Fixed | Fixed | Fixed | — | — |
| ruby2.3 | Not in release | Not in release | Not in release | — | — |
| ruby2.5 | Not in release | Not in release | Not in release | — | Fixed |
| ruby2.7 | Not in release | Not in release | Not in release | Fixed | — |
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads...
7 affected packages
ruby3.3, jruby, ruby2.3, ruby2.5, ruby2.7...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ruby3.3 | Needs evaluation | Not in release | Not in release | Not in release | — |
| jruby | Needs evaluation | Needs evaluation | Not in release | Needs evaluation | Needs evaluation |
| ruby2.3 | Not in release | Not in release | Not in release | Not in release | — |
| ruby2.5 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| ruby2.7 | Not in release | Not in release | Not in release | Needs evaluation | — |
| ruby3.0 | Not in release | Not in release | Needs evaluation | Not in release | — |
| ruby3.2 | Not in release | Needs evaluation | Not in release | Not in release | — |