Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

Privacy Policy
Terms of Service
Contact

CVE-2018-8779 — MEDIUM severity vulnerability | Release Alert

CVE-2018-8779

MEDIUMCVSS v2

Published

April 3, 2018

Affected

4 projects

Assigned by

MITRE

Severity scale

010

Description

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.

Ruby

ChocolateyRuby is a dynamic, open source programming language focusing on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. This package provides a self-contained [Windows-based installer](https://rubyinstaller.org) that includes the Ruby language, an execution environment, important documentation, and more. ## Package Parameters - `/InstallDir` - Ruby installation directory, by default `c:\tools\RubyXY` where XY are major and minor version parts. - `/NoPath` - Do not add ruby bin folder to machine PATH. Example: `choco install ruby --package-parameters="'/NoPath ""/InstallDir:C:\your\install\path""'"` ## Notes - To install ruby development kit ruby installer provides `ridk` command. It provides an easy way to install msys2 via `ridk install 1`, however, the installation is interactive. To accomplish unattended install, use [msys2](https://chocolatey.org/packages/msys2) package.

>= 2.3.0, < 2.3.7, >= 2.4.0, < 2.4.4, >= 2.5.0, < 2.5.1, = 2.6.0, >= 2.2.0, < 2.2.10NVD

ruby/ruby

GitHubThe Ruby Programming Language

More on this CVE

NVD↗GitHub Advisory↗

>= 2.3.0, < 2.3.7, >= 2.4.0, < 2.4.4, >= 2.5.0, < 2.5.1, = 2.6.0, >= 2.2.0, < 2.2.10

NVD

ruby

RubyGemsFIX ME

>= 2.3.0, < 2.3.7, >= 2.4.0, < 2.4.4, >= 2.5.0, < 2.5.1, = 2.6.0, >= 2.2.0, < 2.2.10NVD

ruby

NPMHelper methods from ruby ported to Node.

>= 2.3.0, < 2.3.7, >= 2.4.0, < 2.4.4, >= 2.5.0, < 2.5.1, = 2.6.0, >= 2.2.0, < 2.2.10NVD