NetSight
IP …
high7.5

CVE-2018-8779

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not …

Impact

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.

Affected products

VendorProductAffected versions
Ruby-LangRuby
from 2.2.0 before 2.2.10
from 2.3.0 before 2.3.7
from 2.4.0 before 2.4.4
from 2.5.0 before 2.5.1
Version 2.6.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 17.10
DebianDebian Linux
Versions 7.0, 8.0, 9.0

Weakness classification

CWE-20

References