InfraGuard
Sign in Try it now Buy now

Ruby 1.8 vulnerabilities

54 known CVEs affect the 1.8 line of Ruby.

10.0 max CVSS

Fixed in

1.8.5.2311.8.6.2301.8.7.22
Check your versionruby -v

CVEs affecting 1.8

CVE Title CVSS Exploited EPSS Published
CVE-2008-2662 Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p23... 10.0 — 2008-06-25
CVE-2008-2663 Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.... 10.0 — 2008-06-25
CVE-2017-14064 Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.gen... 9.8 — 2017-09-01
CVE-2011-4121 The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an expon... 9.8 — 2019-11-26
CVE-2017-9225 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... 9.8 — 2017-05-25
CVE-2018-8780 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir... 9.1 — 2018-04-04
CVE-2017-10784 The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2... 8.8 — 2017-09-20
CVE-2015-7551 The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2... 8.4 — 2016-03-24
CVE-2008-2664 The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7... 7.8 — 2008-06-25
CVE-2008-2725 Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 b... 7.8 — 2008-06-25
CVE-2008-2726 Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 b... 7.8 — 2008-06-25
CVE-2008-3656 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::D... 7.8 — 2008-08-13
CVE-2008-4310 httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote at... 7.8 — 2008-12-09
CVE-2011-4815 Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collis... 7.8 — 2011-12-30
CVE-2008-2376 Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent... 7.5 — 2008-07-09
CVE-2008-3655 Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not pro... 7.5 — 2008-08-13
CVE-2008-3657 The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r1... 7.5 — 2008-08-13
CVE-2014-6438 The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial o... 7.5 — 2017-09-07
CVE-2020-25613 An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple... 7.5 — 2020-10-06
CVE-2021-28965 The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly ad... 7.5 — 2021-04-21
CVE-2021-28966 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a p... 7.5 — 2021-07-28
CVE-2021-41819 CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CG... 7.5 — 2022-01-01
CVE-2022-28739 There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.... 7.5 — 2022-05-09
CVE-2017-9229 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... 7.5 — 2017-05-25
CVE-2009-5147 DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries... 7.3 — 2017-03-29
CVE-2009-0642 ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verif... 6.8 — 2009-02-19
CVE-2011-0188 The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on App... 6.8 — 2011-03-23
CVE-2013-4073 The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9... 6.8 — 2013-08-18
CVE-2013-4164 Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview... 6.8 — 2013-11-24
CVE-2020-5247 HTTP Response Splitting in Puma 6.5 — 2020-02-29
CVE-2011-1004 The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1... 6.3 — 2011-03-03
CVE-2015-9096 Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL... 6.1 — 2017-06-13
CVE-2008-3905 resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earli... 5.8 — 2008-09-05
CVE-2021-31810 An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP ser... 5.8 — 2021-07-13
CVE-2011-3624 Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-Fo... 5.3 — 2019-11-26
CVE-2019-16254 Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program... 5.3 — 2019-11-26
CVE-2023-28756 A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishan... 5.3 — 2023-03-31
CVE-2007-5770 The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5... 5.0 — 2007-11-14
CVE-2008-1891 Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before... 5.0 — 2008-04-19
CVE-2008-3443 The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8... 5.0 — 2008-08-15
CVE-2008-3790 The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent a... 5.0 — 2008-08-28
CVE-2009-1904 The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to c... 5.0 — 2009-06-12
CVE-2011-1005 The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-d... 5.0 — 2011-03-03
CVE-2011-2686 Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependen... 5.0 — 2011-08-06
CVE-2011-2705 The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2... 5.0 — 2011-08-06
CVE-2011-3009 Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependen... 5.0 — 2011-08-06
CVE-2012-5371 Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting... 5.0 — 2012-11-28
CVE-2013-1821 lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of s... 5.0 — 2013-04-10
CVE-2012-4466 Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-d... 5.0 — 2013-04-26
CVE-2014-8080 The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remot... 5.0 — 2014-11-04
CVE-2014-4975 Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when usin... 5.0 — 2014-11-16
CVE-2014-8090 The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x befor... 5.0 — 2014-11-22
CVE-2007-5162 The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.... 4.3 — 2007-10-01
CVE-2012-4481 The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to... 4.3 — 2013-05-02

Track these versions on your own servers

InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.

Try the live demo Buy now

Weekly exploited-vulnerability digest

The KEV additions that matter for self-hosted servers, once a week. No other mail.

Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).