Исправлено в
Проверьте свою версию
ruby -vCVE, затрагивающие 1.9
| CVE | Название | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|
| CVE-2008-2662 | Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p23... | 10.0 | — | 2008-06-25 | |
| CVE-2009-4124 | Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows c... | 10.0 | — | 2009-12-12 | |
| CVE-2017-14064 | Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.gen... | 9.8 | — | 2017-09-01 | |
| CVE-2011-4121 | The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an expon... | 9.8 | — | 2019-11-26 | |
| CVE-2017-9225 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | 9.8 | — | 2017-05-25 | |
| CVE-2018-8780 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir... | 9.1 | — | 2018-04-04 | |
| CVE-2017-10784 | The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2... | 8.8 | — | 2017-09-20 | |
| CVE-2015-7551 | The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2... | 8.4 | — | 2016-03-24 | |
| CVE-2008-2664 | The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7... | 7.8 | — | 2008-06-25 | |
| CVE-2008-2726 | Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 b... | 7.8 | — | 2008-06-25 | |
| CVE-2008-3656 | Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::D... | 7.8 | — | 2008-08-13 | |
| CVE-2008-3655 | Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not pro... | 7.5 | — | 2008-08-13 | |
| CVE-2008-3657 | The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r1... | 7.5 | — | 2008-08-13 | |
| CVE-2014-6438 | The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial o... | 7.5 | — | 2017-09-07 | |
| CVE-2020-25613 | An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple... | 7.5 | — | 2020-10-06 | |
| CVE-2021-28965 | The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly ad... | 7.5 | — | 2021-04-21 | |
| CVE-2021-28966 | In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a p... | 7.5 | — | 2021-07-28 | |
| CVE-2021-41819 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CG... | 7.5 | — | 2022-01-01 | |
| CVE-2022-28739 | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.... | 7.5 | — | 2022-05-09 | |
| CVE-2017-9229 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | 7.5 | — | 2017-05-25 | |
| CVE-2009-5147 | DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries... | 7.3 | — | 2017-03-29 | |
| CVE-2010-2489 | Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a cr... | 7.2 | — | 2010-07-10 | |
| CVE-2009-0642 | ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verif... | 6.8 | — | 2009-02-19 | |
| CVE-2011-0188 | The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on App... | 6.8 | — | 2011-03-23 | |
| CVE-2013-4073 | The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9... | 6.8 | — | 2013-08-18 | |
| CVE-2013-4164 | Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview... | 6.8 | — | 2013-11-24 | |
| CVE-2012-5380 | Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in th... | 6.7 | — | 2012-10-11 | |
| CVE-2020-5247 | HTTP Response Splitting in Puma | 6.5 | — | 2020-02-29 | |
| CVE-2013-2065 | (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not per... | 6.4 | — | 2013-11-03 | |
| CVE-2011-1004 | The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1... | 6.3 | — | 2011-03-03 | |
| CVE-2015-9096 | Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL... | 6.1 | — | 2017-06-13 | |
| CVE-2021-31810 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP ser... | 5.8 | — | 2021-07-13 | |
| CVE-2011-3624 | Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-Fo... | 5.3 | — | 2019-11-26 | |
| CVE-2019-16254 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program... | 5.3 | — | 2019-11-26 | |
| CVE-2023-28756 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishan... | 5.3 | — | 2023-03-31 | |
| CVE-2008-1891 | Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before... | 5.0 | — | 2008-04-19 | |
| CVE-2008-3443 | The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8... | 5.0 | — | 2008-08-15 | |
| CVE-2008-3790 | The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent a... | 5.0 | — | 2008-08-28 | |
| CVE-2011-2705 | The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2... | 5.0 | — | 2011-08-06 | |
| CVE-2012-4522 | The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allo... | 5.0 | — | 2012-11-25 | |
| CVE-2012-5371 | Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting... | 5.0 | — | 2012-11-28 | |
| CVE-2013-1821 | lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of s... | 5.0 | — | 2013-04-10 | |
| CVE-2012-4464 | Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass s... | 5.0 | — | 2013-04-26 | |
| CVE-2012-4466 | Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-d... | 5.0 | — | 2013-04-26 | |
| CVE-2014-8080 | The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remot... | 5.0 | — | 2014-11-04 | |
| CVE-2014-4975 | Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when usin... | 5.0 | — | 2014-11-16 | |
| CVE-2014-8090 | The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x befor... | 5.0 | — | 2014-11-22 | |
| CVE-2015-3900 | RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when f... | 5.0 | — | 2015-06-24 | |
| CVE-2013-0256 | darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly gen... | 4.3 | — | 2013-03-01 | |
| CVE-2013-4287 | Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems b... | 4.3 | — | 2013-10-18 | |
| CVE-2013-4363 | Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in R... | 4.3 | — | 2013-10-18 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).