InfraGuard
Sign in Try it now Buy now

Ruby 2.5 vulnerabilities

23 known CVEs affect the 2.5 line of Ruby.

9.8 max CVSSSupport ended 2021-03-31

Fixed in

2.5.1
Check your versionruby -v

CVEs affecting 2.5

CVE Title CVSS Exploited EPSS Published
CVE-2017-17790 The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Comman... 9.8 — 2017-12-20
CVE-2018-16395 An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, a... 9.8 — 2018-11-17
CVE-2018-8780 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir... 9.1 — 2018-04-04
CVE-2017-17405 Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryf... 8.8 — 2017-12-15
CVE-2018-16396 An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-p... 8.1 — 2018-11-17
CVE-2019-16255 Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (... 8.1 — 2019-11-26
CVE-2018-6914 Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.... 7.5 — 2018-04-04
CVE-2018-8777 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an atta... 7.5 — 2018-04-04
CVE-2018-8778 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an atta... 7.5 — 2018-04-04
CVE-2018-8779 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNI... 7.5 — 2018-04-04
CVE-2019-16201 WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regula... 7.5 — 2019-11-26
CVE-2020-25613 An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple... 7.5 — 2020-10-06
CVE-2021-28965 The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly ad... 7.5 — 2021-04-21
CVE-2021-28966 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a p... 7.5 — 2021-07-28
CVE-2021-41819 CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CG... 7.5 — 2022-01-01
CVE-2022-28739 There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.... 7.5 — 2022-05-09
CVE-2019-15845 Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch... 6.5 — 2019-11-27
CVE-2020-5247 HTTP Response Splitting in Puma 6.5 — 2020-02-29
CVE-2021-31810 An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP ser... 5.8 — 2021-07-13
CVE-2017-17742 Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an H... 5.3 — 2018-04-03
CVE-2019-16254 Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program... 5.3 — 2019-11-26
CVE-2020-10933 An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSo... 5.3 — 2020-05-04
CVE-2023-28756 A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishan... 5.3 — 2023-03-31

Track these versions on your own servers

InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.

Try the live demo Buy now

Weekly exploited-vulnerability digest

The KEV additions that matter for self-hosted servers, once a week. No other mail.

Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).