Tainting Issue in Ruby Language Prior to 2.6 Preview 3
CVE-2018-16396

8.1HIGH

Key Information:

Vendor

Ruby-lang

Status
Ruby
Vendor
CVE Published:
16 November 2018

What is CVE-2018-16396?

A tainting vulnerability exists in Ruby prior to version 2.6.0-preview3 that fails to appropriately mark certain unpacked strings as tainted. This lack of tainting can lead to potential security risks, as it allows data that should be considered unsafe to pass through the system unchecked. Versions of Ruby affected include 2.3.8 and earlier, 2.4.x before 2.4.5, and 2.5.x before 2.5.2. Remediation is imperative to ensure that tainted data is correctly identified and handled.

References

https://hackerone.com/reports/385070
x_refsource_MISC
https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-p...
x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:3729
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.