CVE-2018-16396

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
Affected Products (NVD)
VendorProductVersion
ruby-langruby
2.3.0 ≤
𝑥
≤ 2.3.7
ruby-langruby
2.4.0 ≤
𝑥
≤ 2.4.4
ruby-langruby
2.5.0 ≤
𝑥
≤ 2.5.1
ruby-langruby
2.6.0:preview1
ruby-langruby
2.6.0:preview2
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
debiandebian_linux
8.0
debiandebian_linux
9.0
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux
7.4
redhatenterprise_linux
7.5
redhatenterprise_linux
7.6
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby1.9.1
bionic
dne
cosmic
dne
trusty
Fixed 1.9.3.484-2ubuntu1.13
released
xenial
dne
ruby2.0
bionic
dne
cosmic
dne
trusty
Fixed 2.0.0.484-1ubuntu2.11
released
xenial
dne
ruby2.3
bionic
dne
cosmic
dne
trusty
dne
xenial
Fixed 2.3.1-2~16.04.11
released
ruby2.5
bionic
Fixed 2.5.1-1ubuntu1.1
released
cosmic
Fixed 2.5.1-5ubuntu4.1
released
trusty
dne
xenial
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libruby2_1-2_1
suse enterprise sap 12 SP4
2.1.9-19.3.2
fixed
suse enterprise sap 12 SP5
2.1.9-19.3.2
fixed
suse enterprise server 12 SP2
2.1.9-19.3.2
fixed
suse enterprise server 12 SP3
2.1.9-19.3.2
fixed
suse enterprise server 12 SP4
2.1.9-19.3.2
fixed
suse enterprise server 12 SP5
2.1.9-19.3.2
fixed
libruby2_5-2_5
suse enterprise desktop 15
2.5.5-4.3.1
fixed
suse enterprise desktop 15 SP1
2.5.5-4.3.1
fixed
suse enterprise desktop 15 SP2
2.5.5-4.3.1
fixed
suse enterprise desktop 15 SP3
2.5.5-4.3.1
fixed
suse enterprise desktop 15 SP4
2.5.5-4.3.1
fixed
suse enterprise desktop 15 SP5
2.5.5-4.3.1
fixed
suse enterprise desktop 15 SP6
2.5.5-4.3.1
fixed
suse enterprise desktop 15 SP7
2.5.9-150700.22.16
fixed
suse enterprise sap 15
2.5.5-4.3.1
fixed
suse enterprise sap 15 SP1
2.5.5-4.3.1
fixed
suse enterprise sap 15 SP2
2.5.5-4.3.1
fixed
suse enterprise sap 15 SP3
2.5.5-4.3.1
fixed
suse enterprise sap 15 SP4
2.5.5-4.3.1
fixed
suse enterprise sap 15 SP5
2.5.5-4.3.1
fixed
suse enterprise sap 15 SP6
2.5.5-4.3.1
fixed
suse enterprise sap 15 SP7
2.5.9-150700.22.16
fixed
suse enterprise server 15
2.5.5-4.3.1
fixed
suse enterprise server 15 SP1
2.5.5-4.3.1
fixed
suse enterprise server 15 SP2
2.5.5-4.3.1
fixed
suse enterprise server 15 SP3
2.5.5-4.3.1
fixed
suse enterprise server 15 SP4
2.5.5-4.3.1
fixed
suse enterprise server 15 SP5
2.5.5-4.3.1
fixed
suse enterprise server 15 SP6
2.5.5-4.3.1
fixed
suse enterprise server 15 SP7
2.5.9-150700.22.16
fixed
yast2-ruby-bindings
suse enterprise server 12 SP2
3.1.53-9.8.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
ruby
RHEL 7
0:2.0.0.648-36.el7
fixed
ruby-devel
RHEL 7
0:2.0.0.648-36.el7
fixed
ruby-doc
RHEL 7
0:2.0.0.648-36.el7
fixed
ruby-irb
RHEL 7
0:2.0.0.648-36.el7
fixed
ruby-libs
RHEL 7
0:2.0.0.648-36.el7
fixed
ruby-tcltk
RHEL 7
0:2.0.0.648-36.el7
fixed
rubygem-bigdecimal
RHEL 7
0:1.2.0-36.el7
fixed
rubygem-io-console
RHEL 7
0:0.4.2-36.el7
fixed
rubygem-json
RHEL 7
0:1.7.7-36.el7
fixed
rubygem-minitest
RHEL 7
0:4.3.2-36.el7
fixed
rubygem-psych
RHEL 7
0:2.0.0-36.el7
fixed
rubygem-rake
RHEL 7
0:0.9.6-36.el7
fixed
rubygem-rdoc
RHEL 7
0:4.0.0-36.el7
fixed
rubygems
RHEL 7
0:2.0.14.1-36.el7
fixed
rubygems-devel
RHEL 7
0:2.0.14.1-36.el7
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ruby
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.1
fixed
ruby-debuginfo
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.1
fixed
ruby-devel
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.1
fixed
ruby-doc
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.1
fixed
ruby-irb
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.1
fixed
ruby-libs
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.1
fixed
ruby-tcltk
Amazon Linux 2
0:2.0.0.648-36.amzn2.0.1
fixed
ruby20
Amazon Linux 1
0:2.0.0.648-1.33.amzn1
fixed
ruby20-debuginfo
Amazon Linux 1
0:2.0.0.648-1.33.amzn1
fixed
ruby20-devel
Amazon Linux 1
0:2.0.0.648-1.33.amzn1
fixed
ruby20-doc
Amazon Linux 1
0:2.0.0.648-1.33.amzn1
fixed
ruby20-irb
Amazon Linux 1
0:2.0.0.648-1.33.amzn1
fixed
ruby20-libs
Amazon Linux 1
0:2.0.0.648-1.33.amzn1
fixed
ruby23
Amazon Linux 1
0:2.3.8-1.20.amzn1
fixed
ruby23-debuginfo
Amazon Linux 1
0:2.3.8-1.20.amzn1
fixed
ruby23-devel
Amazon Linux 1
0:2.3.8-1.20.amzn1
fixed
ruby23-doc
Amazon Linux 1
0:2.3.8-1.20.amzn1
fixed
ruby23-irb
Amazon Linux 1
0:2.3.8-1.20.amzn1
fixed
ruby23-libs
Amazon Linux 1
0:2.3.8-1.20.amzn1
fixed
ruby24
Amazon Linux 1
0:2.4.5-1.30.7.amzn1
fixed
ruby24-debuginfo
Amazon Linux 1
0:2.4.5-1.30.7.amzn1
fixed
ruby24-devel
Amazon Linux 1
0:2.4.5-1.30.7.amzn1
fixed
ruby24-doc
Amazon Linux 1
0:2.4.5-1.30.7.amzn1
fixed
ruby24-irb
Amazon Linux 1
0:2.4.5-1.30.7.amzn1
fixed
ruby24-libs
Amazon Linux 1
0:2.4.5-1.30.7.amzn1
fixed
rubygem-bigdecimal
Amazon Linux 2
0:1.2.0-36.amzn2.0.1
fixed
rubygem-io-console
Amazon Linux 2
0:0.4.2-36.amzn2.0.1
fixed
rubygem-json
Amazon Linux 2
0:1.7.7-36.amzn2.0.1
fixed
rubygem-minitest
Amazon Linux 2
0:4.3.2-36.amzn2.0.1
fixed
rubygem-psych
Amazon Linux 2
0:2.0.0-36.amzn2.0.1
fixed
rubygem-rake
Amazon Linux 2
0:0.9.6-36.amzn2.0.1
fixed
rubygem-rdoc
Amazon Linux 2
0:4.0.0-36.amzn2.0.1
fixed
rubygem20-bigdecimal
Amazon Linux 1
0:1.2.0-1.33.amzn1
fixed
rubygem20-io-console
Amazon Linux 1
0:0.4.2-1.33.amzn1
fixed
rubygem20-psych
Amazon Linux 1
0:2.0.0-1.33.amzn1
fixed
rubygem23-bigdecimal
Amazon Linux 1
0:1.2.8-1.20.amzn1
fixed
rubygem23-did_you_mean
Amazon Linux 1
0:1.0.0-1.20.amzn1
fixed
rubygem23-io-console
Amazon Linux 1
0:0.4.5-1.20.amzn1
fixed
rubygem23-json
Amazon Linux 1
0:1.8.3.1-1.20.amzn1
fixed
rubygem23-psych
Amazon Linux 1
0:2.1.0.1-1.20.amzn1
fixed
rubygem24-bigdecimal
Amazon Linux 1
0:1.3.2-1.30.7.amzn1
fixed
rubygem24-did_you_mean
Amazon Linux 1
0:1.1.0-1.30.7.amzn1
fixed
rubygem24-io-console
Amazon Linux 1
0:0.4.6-1.30.7.amzn1
fixed
rubygem24-json
Amazon Linux 1
0:2.0.4-1.30.7.amzn1
fixed
rubygem24-psych
Amazon Linux 1
0:2.2.2-1.30.7.amzn1
fixed
rubygem24-xmlrpc
Amazon Linux 1
0:0.2.1-1.30.7.amzn1
fixed
rubygems
Amazon Linux 2
0:2.0.14.1-36.amzn2.0.1
fixed
rubygems-devel
Amazon Linux 2
0:2.0.14.1-36.amzn2.0.1
fixed
rubygems20
Amazon Linux 1
0:2.0.14.1-1.33.amzn1
fixed
rubygems20-devel
Amazon Linux 1
0:2.0.14.1-1.33.amzn1
fixed
rubygems23
Amazon Linux 1
0:2.5.2.3-1.20.amzn1
fixed
rubygems23-devel
Amazon Linux 1
0:2.5.2.3-1.20.amzn1
fixed
rubygems24
Amazon Linux 1
0:2.6.14.3-1.30.7.amzn1
fixed
rubygems24-devel
Amazon Linux 1
0:2.6.14.3-1.30.7.amzn1
fixed
References
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
http://www.securitytracker.com/id/1042106
https://access.redhat.com/errata/RHSA-2018:3729
https://access.redhat.com/errata/RHSA-2018:3730
https://access.redhat.com/errata/RHSA-2018:3731
https://access.redhat.com/errata/RHSA-2019:2028
https://hackerone.com/reports/385070
https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html
https://security.netapp.com/advisory/ntap-20190221-0002/
https://usn.ubuntu.com/3808-1/
https://www.debian.org/security/2018/dsa-4332
https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/
https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
http://www.securitytracker.com/id/1042106
https://access.redhat.com/errata/RHSA-2018:3729
https://access.redhat.com/errata/RHSA-2018:3730
https://access.redhat.com/errata/RHSA-2018:3731
https://access.redhat.com/errata/RHSA-2019:2028
https://hackerone.com/reports/385070
https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html
https://security.netapp.com/advisory/ntap-20190221-0002/
https://usn.ubuntu.com/3808-1/
https://www.debian.org/security/2018/dsa-4332
https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/
https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/