Vérifiez votre version
ruby -vBranches de versions concernées
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLab | ≥ 3.3.0 < 3.3.13 ≥ 3.4.0 < 3.4.12 ≥ 4.0.0 < 4.0.8 | 10.0 | KEV | 69.3% | 2026-10-13 |
| CVE-2026-46727 | An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-ba... | ≥ 4.0.0 < 4.0.5 | 8.1 | — | 2026-05-22 | |
| CVE-2023-28756 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishan... | ≤ 2.7.7 | 5.3 | — | 2023-03-31 | |
| CVE-2021-33621 | The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting... | ≥ 2.7.0 < 2.7.7 ≥ 3.0.0 < 3.0.5 ≥ 3.1.0 < 3.1.3 | 8.8 | — | 2022-11-18 | |
| CVE-2022-28738 | A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim at... | ≥ 3.0.0 < 3.0.4 ≥ 3.1.0 < 3.1.2 | 9.8 | — | 2022-05-09 | |
| CVE-2022-28739 | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.... | < 2.6.10 ≥ 2.7.0 < 2.7.6 ≥ 3.0.0 < 3.0.4 | 7.5 | — | 2022-05-09 | |
| CVE-2021-41817 | Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a lo... | ≥ 2.6.0 < 2.6.9 ≥ 2.7.0 < 2.7.5 ≥ 3.0.0 < 3.0.3 | 7.5 | — | 2022-01-01 | |
| CVE-2021-41819 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CG... | ≤ 2.6.8 ≥ 2.7.0 < 2.7.5 ≥ 3.0.0 < 3.0.3 | 7.5 | — | 2022-01-01 | |
| CVE-2021-32066 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not... | ≥ 2.6.0 ≤ 2.6.7 ≥ 2.7.0 ≤ 2.7.3 ≥ 3.0.0 ≤ 3.0.1 | 7.4 | — | 2021-08-01 | |
| CVE-2021-28966 | In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a p... | < 2.7.3 ≥ 3.0.0 < 3.0.1 | 7.5 | — | 2021-07-28 | |
| CVE-2021-31810 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP ser... | ≤ 2.6.7 ≥ 2.7.0 ≤ 2.7.3 ≥ 3.0.0 ≤ 3.0.1 | 5.8 | — | 2021-07-13 | |
| CVE-2021-28965 | The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly ad... | < 2.6.7 ≥ 2.7.0 < 2.7.3 ≥ 3.0.0 < 3.0.1 | 7.5 | — | 2021-04-21 | |
| CVE-2020-25613 | An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple... | ≤ 2.5.8 ≥ 2.6.0 ≤ 2.6.6 ≥ 2.7.0 ≤ 2.7.1 | 7.5 | — | 2020-10-06 | |
| CVE-2020-10933 | An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSo... | ≥ 2.5.0 ≤ 2.5.7 ≥ 2.6.0 ≤ 2.6.5 = 2.7.0 | 5.3 | — | 2020-05-04 | |
| CVE-2020-5247 | HTTP Response Splitting in Puma | ≤ 2.3.0 ≥ 2.4.0 ≤ 2.4.7 ≥ 2.5.0 ≤ 2.5.6 | 6.5 | — | 2020-02-29 | |
| CVE-2016-2338 | An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Ps... | = 2.2.2 = 2.3.0 | 9.8 | — | 2020-02-14 | |
| CVE-2015-1855 | verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6,... | ≥ 2.1.0 < 2.1.6 ≥ 2.2.0 < 2.2.2 = 2.0.0 | 5.9 | — | 2019-11-30 | |
| CVE-2019-15845 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch... | ≥ 2.4.0 ≤ 2.4.7 ≥ 2.5.0 ≤ 2.5.6 ≥ 2.6.0 ≤ 2.6.4 | 6.5 | — | 2019-11-27 | |
| CVE-2011-4121 | The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an expon... | ≥ 1.8.7.334 < 1.9.3 | 9.8 | — | 2019-11-26 | |
| CVE-2011-3624 | Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-Fo... | = 1.8.7 = 1.9.2 | 5.3 | — | 2019-11-26 | |
| CVE-2019-16201 | WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regula... | ≥ 2.4.0 ≤ 2.4.7 ≥ 2.5.0 ≤ 2.5.6 ≥ 2.6.0 ≤ 2.6.4 | 7.5 | — | 2019-11-26 | |
| CVE-2019-16254 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program... | ≤ 2.3.0 ≥ 2.4.0 ≤ 2.4.7 ≥ 2.5.0 ≤ 2.5.6 | 5.3 | — | 2019-11-26 | |
| CVE-2019-16255 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (... | ≥ 2.4.0 ≤ 2.4.7 ≥ 2.5.0 ≤ 2.5.6 ≥ 2.6.0 ≤ 2.6.4 | 8.1 | — | 2019-11-26 | |
| CVE-2018-16395 | An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, a... | ≥ 2.3.0 ≤ 2.3.7 ≥ 2.4.0 ≤ 2.4.4 ≥ 2.5.0 ≤ 2.5.1 | 9.8 | — | 2018-11-17 | |
| CVE-2018-16396 | An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-p... | ≥ 2.3.0 ≤ 2.3.7 ≥ 2.4.0 ≤ 2.4.4 ≥ 2.5.0 ≤ 2.5.1 | 8.1 | — | 2018-11-17 | |
| CVE-2018-6914 | Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.... | ≥ 2.2.0 < 2.2.10 ≥ 2.3.0 < 2.3.7 ≥ 2.4.0 < 2.4.4 | 7.5 | — | 2018-04-04 | |
| CVE-2018-8777 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an atta... | ≥ 2.2.0 < 2.2.10 ≥ 2.3.0 < 2.3.7 ≥ 2.4.0 < 2.4.4 | 7.5 | — | 2018-04-04 | |
| CVE-2018-8778 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an atta... | ≥ 2.2.0 < 2.2.10 ≥ 2.3.0 < 2.3.7 ≥ 2.4.0 < 2.4.4 | 7.5 | — | 2018-04-04 | |
| CVE-2018-8779 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNI... | ≥ 2.2.0 < 2.2.10 ≥ 2.3.0 < 2.3.7 ≥ 2.4.0 < 2.4.4 | 7.5 | — | 2018-04-04 | |
| CVE-2018-8780 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir... | < 2.2.10 ≥ 2.3.0 < 2.3.7 ≥ 2.4.0 < 2.4.4 | 9.1 | — | 2018-04-04 | |
| CVE-2017-17742 | Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an H... | ≥ 2.2.0 < 2.2.10 ≥ 2.3.0 < 2.3.7 ≥ 2.4.0 < 2.4.4 | 5.3 | — | 2018-04-03 | |
| CVE-2017-17790 | The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Comman... | ≥ 2.2 ≤ 2.2.8 ≥ 2.3 ≤ 2.3.5 ≥ 2.4 ≤ 2.4.2 | 9.8 | — | 2017-12-20 | |
| CVE-2017-17405 | Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryf... | ≥ 2.2 ≤ 2.2.8 ≥ 2.3 ≤ 2.3.5 ≥ 2.4 ≤ 2.4.2 | 8.8 | — | 2017-12-15 | |
| CVE-2017-10784 | The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2... | ≤ 2.2.7 = 2.3.0 = 2.3.1 | 8.8 | — | 2017-09-20 | |
| CVE-2017-14033 | The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.... | = 2.2.0 = 2.2.1 = 2.2.2 | 7.5 | — | 2017-09-20 | |
| CVE-2017-0898 | Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious speci... | = 2.2.0 = 2.2.1 = 2.2.2 | 9.1 | — | 2017-09-16 | |
| CVE-2014-6438 | The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial o... | ≤ 1.9.2 | 7.5 | — | 2017-09-07 | |
| CVE-2017-14064 | Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.gen... | ≤ 2.2.7 = 2.3.0 = 2.3.1 | 9.8 | — | 2017-09-01 | |
| CVE-2017-11465 | The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (i... | = 2.4.1 | 9.8 | — | 2017-07-20 | |
| CVE-2015-9096 | Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL... | ≤ 2.4.0 | 6.1 | — | 2017-06-13 | |
| CVE-2017-9225 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | ≤ 2.4.1 | 9.8 | — | 2017-05-25 | |
| CVE-2017-9229 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | ≤ 2.4.1 | 7.5 | — | 2017-05-25 | |
| CVE-2017-6181 | The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as u... | = 2.4.0 | 7.5 | — | 2017-04-03 | |
| CVE-2009-5147 | DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries... | = 1.8.0 = 1.9.0 = 1.9.2 | 7.3 | — | 2017-03-29 | |
| CVE-2016-2336 | Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker pa... | = 2.2.2 = 2.3.0 | 9.8 | — | 2017-01-07 | |
| CVE-2016-2337 | Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object t... | = 2.2.2 = 2.3.0 | 9.8 | — | 2017-01-07 | |
| CVE-2016-2339 | An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functional... | = 2.2.2 = 2.3.0 | 9.8 | — | 2017-01-07 | |
| CVE-2015-7551 | The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2... | ≤ 2.0.0-p647 = 2.1.0 = 2.1.1 | 8.4 | — | 2016-03-24 | |
| CVE-2015-3900 | RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when f... | = 1.9 = 1.9.1 = 1.9.2 | 5.0 | — | 2015-06-24 | |
| CVE-2014-8090 | The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x befor... | ≤ 1.9.3 = 1.9.3 = 2.0.0 | 5.0 | — | 2014-11-22 | |
| CVE-2014-4975 | Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when usin... | ≤ 1.9.3 = 2.0 = 2.0.0 | 5.0 | — | 2014-11-16 | |
| CVE-2014-8080 | The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remot... | ≤ 1.9.3 = 1.9.3 = 2.0.0 | 5.0 | — | 2014-11-04 | |
| CVE-2014-2734 | The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reope... | = 2.0 = 2.0.0 = 2.1 | 5.8 | — | 2014-04-25 | |
| CVE-2013-4164 | Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview... | = 1.8 = 1.9 = 1.9.1 | 6.8 | — | 2013-11-24 | |
| CVE-2013-2065 | (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not per... | = 1.9 = 1.9.1 = 1.9.2 | 6.4 | — | 2013-11-03 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).