Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/938482?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "type": "deb", "namespace": "debian", "name": "ruby2.7", "version": "2.7.4-1+deb11u1", "qualifiers": { "distro": "bullseye" }, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "2.7.4-1+deb11u2", "latest_non_vulnerable_version": "2.7.4-1+deb11u5", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11928?format=api", "vulnerability_id": "VCID-1vp9-6q85-5ffv", "summary": "Reliance on Cookies without Validation and Integrity Checking in a Security Decision\nCGI::Cookie.parse in Ruby mishandles security prefixes in cookie names. This also affects the CGI gem for Ruby.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41819.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41819.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41819", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73218", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73197", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73283", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.7324", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73187", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73247", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73267", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73242", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73228", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00755", "scoring_system": "epss", "scoring_elements": "0.73192", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41816", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41816" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/cgi", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-41819.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-41819.yml" }, { "reference_url": "https://hackerone.com/reports/910552", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-22T14:43:38Z/" } ], "url": "https://hackerone.com/reports/910552" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-22T14:43:38Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-22T14:43:38Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "reference_url": "https://security.gentoo.org/glsa/202401-27", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-22T14:43:38Z/" } ], "url": "https://security.gentoo.org/glsa/202401-27" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220121-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20220121-0003" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220121-0003/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-22T14:43:38Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20220121-0003/" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-22T14:43:38Z/" } ], "url": "https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026757", "reference_id": "2026757", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026757" }, { "reference_url": "https://security.archlinux.org/AVG-2555", "reference_id": "AVG-2555", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2555" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41819", "reference_id": "CVE-2021-41819", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41819" }, { "reference_url": "https://github.com/advisories/GHSA-4vf4-qmvg-mh7h", "reference_id": "GHSA-4vf4-qmvg-mh7h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4vf4-qmvg-mh7h" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0543", "reference_id": "RHSA-2022:0543", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0543" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0544", "reference_id": "RHSA-2022:0544", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0544" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0708", "reference_id": "RHSA-2022:0708", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0708" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:5779", "reference_id": "RHSA-2022:5779", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:5779" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6447", "reference_id": "RHSA-2022:6447", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6447" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6450", "reference_id": "RHSA-2022:6450", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6450" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6855", "reference_id": "RHSA-2022:6855", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6855" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6856", "reference_id": "RHSA-2022:6856", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6856" }, { "reference_url": "https://usn.ubuntu.com/5235-1/", "reference_id": "USN-5235-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5235-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-41819", "GHSA-4vf4-qmvg-mh7h" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1vp9-6q85-5ffv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41900?format=api", "vulnerability_id": "VCID-2sv2-6snv-2bd3", "summary": "Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28739.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28739.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28739", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00306", "scoring_system": "epss", "scoring_elements": "0.53849", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00306", "scoring_system": "epss", "scoring_elements": "0.53845", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00306", "scoring_system": "epss", "scoring_elements": "0.53828", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00306", "scoring_system": "epss", "scoring_elements": "0.53812", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00306", "scoring_system": "epss", "scoring_elements": "0.53746", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00306", "scoring_system": "epss", "scoring_elements": "0.53773", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00306", "scoring_system": "epss", "scoring_elements": "0.53798", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00306", "scoring_system": "epss", "scoring_elements": "0.53796", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28739" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28739", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28739" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009957", "reference_id": "1009957", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009957" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2075687", "reference_id": "2075687", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2075687" }, { "reference_url": "https://security.archlinux.org/AVG-2757", "reference_id": "AVG-2757", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2757" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:5338", "reference_id": "RHSA-2022:5338", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:5338" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6447", "reference_id": "RHSA-2022:6447", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6447" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6450", "reference_id": "RHSA-2022:6450", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6450" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6585", "reference_id": "RHSA-2022:6585", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6585" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6855", "reference_id": "RHSA-2022:6855", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6855" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6856", "reference_id": "RHSA-2022:6856", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6856" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:7025", "reference_id": "RHSA-2023:7025", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:7025" }, { "reference_url": "https://usn.ubuntu.com/5462-1/", "reference_id": "USN-5462-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5462-1/" }, { "reference_url": "https://usn.ubuntu.com/5462-2/", "reference_id": "USN-5462-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5462-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938488?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u2?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u2%3Fdistro=bullseye" } ], "aliases": [ "CVE-2022-28739", "GHSA-mvgc-rxvg-hqc6" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2sv2-6snv-2bd3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/81473?format=api", "vulnerability_id": "VCID-3d14-jf3q-xqbf", "summary": "ruby: BasicSocket#read_nonblock method leads to information disclosure", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10933.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10933.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-10933", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.62985", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.6312", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63121", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63107", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63084", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63044", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63072", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63037", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63087", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63104", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-10933" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10663", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10663" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10933", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10933" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10933", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10933" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1833291", "reference_id": "1833291", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1833291" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2104", "reference_id": "RHSA-2021:2104", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2104" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2230", "reference_id": "RHSA-2021:2230", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2230" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2587", "reference_id": "RHSA-2021:2587", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2587" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2588", "reference_id": "RHSA-2021:2588", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2588" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://usn.ubuntu.com/4882-1/", "reference_id": "USN-4882-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4882-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938484?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.1-1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.1-1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2020-10933", "GHSA-g5hm-28jr-53fh" ], "risk_score": 2.4, "exploitability": "0.5", "weighted_severity": "4.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3d14-jf3q-xqbf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16473?format=api", "vulnerability_id": "VCID-5mfh-yzfk-cqaa", "summary": "StringIO buffer overread vulnerability\nAn issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.\n\nThe `ungetbyte` and `ungetc` methods on a StringIO can read past the end of a string, and a subsequent call to `StringIO.gets` may return the memory value.\n\nThis vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.\n\nWe recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:\n\n* For Ruby 3.0 users: Update to `stringio` 3.0.1.1\n* For Ruby 3.1 users: Update to `stringio` 3.1.0.2\n\nYou can use `gem update stringio` to update it. If you are using bundler, please add `gem \"stringio\", \">= 3.0.1.2\"` to your `Gemfile`.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27280.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27280.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-27280", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0706", "scoring_system": "epss", "scoring_elements": "0.91529", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.0706", "scoring_system": "epss", "scoring_elements": "0.91508", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0706", "scoring_system": "epss", "scoring_elements": "0.91495", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0706", "scoring_system": "epss", "scoring_elements": "0.91482", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0706", "scoring_system": "epss", "scoring_elements": "0.91467", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0706", "scoring_system": "epss", "scoring_elements": "0.91473", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0706", "scoring_system": "epss", "scoring_elements": "0.91506", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0706", "scoring_system": "epss", "scoring_elements": "0.91501", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-27280" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27280", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27280" }, { "reference_url": "http://seclists.org/fulldisclosure/2025/Sep/53", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2025/Sep/53" }, { "reference_url": "http://seclists.org/fulldisclosure/2025/Sep/54", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2025/Sep/54" }, { "reference_url": "http://seclists.org/fulldisclosure/2025/Sep/55", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2025/Sep/55" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stringio/CVE-2024-27280.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stringio/CVE-2024-27280.yml" }, { "reference_url": "https://github.com/ruby/stringio", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/stringio" }, { "reference_url": "https://github.com/ruby/stringio/commit/0e596524097706263d10900ca180898e4a8f5233", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/stringio/commit/0e596524097706263d10900ca180898e4a8f5233" }, { "reference_url": "https://github.com/ruby/stringio/commit/c58c5f54f1eab99665ea6a161d29ff6a7490afc8", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/stringio/commit/c58c5f54f1eab99665ea6a161d29ff6a7490afc8" }, { "reference_url": "https://hackerone.com/reports/1399856", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-05-09T18:08:05Z/" } ], "url": "https://hackerone.com/reports/1399856" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XYDHPHEZI7OQXTQKTDZHGZNPIJH7ZV5N", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XYDHPHEZI7OQXTQKTDZHGZNPIJH7ZV5N" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27280", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27280" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20250502-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20250502-0003" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-05-09T18:08:05Z/" } ], "url": "https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069966", "reference_id": "1069966", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069966" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270750", "reference_id": "2270750", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270750" }, { "reference_url": "https://github.com/advisories/GHSA-v5h6-c2hv-hv3r", "reference_id": "GHSA-v5h6-c2hv-hv3r", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v5h6-c2hv-hv3r" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3500", "reference_id": "RHSA-2024:3500", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3500" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3546", "reference_id": "RHSA-2024:3546", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3546" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3668", "reference_id": "RHSA-2024:3668", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3668" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3670", "reference_id": "RHSA-2024:3670", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3670" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3671", "reference_id": "RHSA-2024:3671", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3671" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3838", "reference_id": "RHSA-2024:3838", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3838" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:4499", "reference_id": "RHSA-2024:4499", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:4499" }, { "reference_url": "https://usn.ubuntu.com/6853-1/", "reference_id": "USN-6853-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6853-1/" }, { "reference_url": "https://usn.ubuntu.com/7734-1/", "reference_id": "USN-7734-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7734-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938488?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u2?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u2%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-27280", "GHSA-v5h6-c2hv-hv3r" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5mfh-yzfk-cqaa" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41896?format=api", "vulnerability_id": "VCID-9g2w-sc9w-eyce", "summary": "Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33621.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-33621.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33621", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.80528", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.80536", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.80522", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.8055", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.80532", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.80475", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.80481", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.80502", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.01412", "scoring_system": "epss", "scoring_elements": "0.80492", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.01562", "scoring_system": "epss", "scoring_elements": "0.81521", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33621" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33621", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33621" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-33621.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-33621.yml" }, { "reference_url": "https://hackerone.com/reports/1204695", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/1204695" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33621", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33621" }, { "reference_url": "https://security.gentoo.org/glsa/202401-27", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202401-27" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221228-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20221228-0004" }, { "reference_url": "https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621" }, { "reference_url": "https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024799", "reference_id": "1024799", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024799" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2149706", "reference_id": "2149706", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2149706" }, { "reference_url": "https://github.com/advisories/GHSA-vc47-6rqg-c7f5", "reference_id": "GHSA-vc47-6rqg-c7f5", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vc47-6rqg-c7f5" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3291", "reference_id": "RHSA-2023:3291", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3291" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3821", "reference_id": "RHSA-2023:3821", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3821" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:7025", "reference_id": "RHSA-2023:7025", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:7025" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:1431", "reference_id": "RHSA-2024:1431", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:1431" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:1576", "reference_id": "RHSA-2024:1576", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:1576" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3500", "reference_id": "RHSA-2024:3500", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3500" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3838", "reference_id": "RHSA-2024:3838", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3838" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:4542", "reference_id": "RHSA-2024:4542", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:4542" }, { "reference_url": "https://usn.ubuntu.com/5806-1/", "reference_id": "USN-5806-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5806-1/" }, { "reference_url": "https://usn.ubuntu.com/5806-2/", "reference_id": "USN-5806-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5806-2/" }, { "reference_url": "https://usn.ubuntu.com/5806-3/", "reference_id": "USN-5806-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5806-3/" }, { "reference_url": "https://usn.ubuntu.com/6181-1/", "reference_id": "USN-6181-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6181-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938488?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u2?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u2%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-33621", "GHSA-vc47-6rqg-c7f5" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9g2w-sc9w-eyce" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/17012?format=api", "vulnerability_id": "VCID-9x9w-2k98-wydm", "summary": "Ruby Time component ReDoS issue\nA ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28756.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28756.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28756", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00826", "scoring_system": "epss", "scoring_elements": "0.74463", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00826", "scoring_system": "epss", "scoring_elements": "0.74472", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00826", "scoring_system": "epss", "scoring_elements": "0.74491", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00826", "scoring_system": "epss", "scoring_elements": "0.74469", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00826", "scoring_system": "epss", "scoring_elements": "0.74452", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00826", "scoring_system": "epss", "scoring_elements": "0.74419", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00826", "scoring_system": "epss", "scoring_elements": "0.74444", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00826", "scoring_system": "epss", "scoring_elements": "0.74418", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00914", "scoring_system": "epss", "scoring_elements": "0.75917", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28756" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28756", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28756" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/time", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/time" }, { "reference_url": "https://github.com/ruby/time/releases", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/time/releases" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z" }, { "reference_url": "https://security.gentoo.org/glsa/202401-27", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://security.gentoo.org/glsa/202401-27" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20230526-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20230526-0004" }, { "reference_url": "https://www.ruby-lang.org/en/downloads/releases", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/downloads/releases" }, { "reference_url": "https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released" }, { "reference_url": "https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756" }, { "reference_url": "https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036283", "reference_id": "1036283", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036283" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038408", "reference_id": "1038408", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038408" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184061", "reference_id": "2184061", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184061" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28756", "reference_id": "CVE-2023-28756", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28756" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/time/CVE-2023-28756.yml", "reference_id": "CVE-2023-28756.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/time/CVE-2023-28756.yml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/", "reference_id": "FFZANOQA4RYX7XCB42OO3P24DQKWHEKA", "reference_type": "", "scores": [ { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/", "reference_id": "G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T", "reference_type": "", "scores": [ { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/" }, { "reference_url": "https://github.com/advisories/GHSA-fg7x-g82r-94qc", "reference_id": "GHSA-fg7x-g82r-94qc", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fg7x-g82r-94qc" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20230526-0004/", "reference_id": "ntap-20230526-0004", "reference_type": "", "scores": [ { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20230526-0004/" }, { "reference_url": "https://github.com/ruby/time/releases/", "reference_id": "releases", "reference_type": "", "scores": [ { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://github.com/ruby/time/releases/" }, { "reference_url": "https://www.ruby-lang.org/en/downloads/releases/", "reference_id": "releases", "reference_type": "", "scores": [ { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://www.ruby-lang.org/en/downloads/releases/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3291", "reference_id": "RHSA-2023:3291", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3291" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3821", "reference_id": "RHSA-2023:3821", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3821" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:7025", "reference_id": "RHSA-2023:7025", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:7025" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:1431", "reference_id": "RHSA-2024:1431", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:1431" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:1576", "reference_id": "RHSA-2024:1576", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:1576" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3500", "reference_id": "RHSA-2024:3500", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3500" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3838", "reference_id": "RHSA-2024:3838", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3838" }, { "reference_url": "https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/", "reference_id": "ruby-3-2-0-released", "reference_type": "", "scores": [ { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/" }, { "reference_url": "https://usn.ubuntu.com/6055-1/", "reference_id": "USN-6055-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6055-1/" }, { "reference_url": "https://usn.ubuntu.com/6087-1/", "reference_id": "USN-6087-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6087-1/" }, { "reference_url": "https://usn.ubuntu.com/6181-1/", "reference_id": "USN-6181-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6181-1/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/", "reference_id": "WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z", "reference_type": "", "scores": [ { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-26T19:59:50Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938488?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u2?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u2%3Fdistro=bullseye" } ], "aliases": [ "CVE-2023-28756", "GHSA-fg7x-g82r-94qc" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9x9w-2k98-wydm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11172?format=api", "vulnerability_id": "VCID-a1z8-2fdu-1uhd", "summary": "Arbitrary Code Execution in Rdoc\nIn RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-31799.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-31799.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-31799", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57547", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57463", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57567", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57543", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57596", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.576", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57615", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57595", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57602", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00351", "scoring_system": "epss", "scoring_elements": "0.57573", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-31799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rdoc", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc" }, { "reference_url": "https://github.com/ruby/rdoc/commit/a7f5d6ab88632b3b482fe10611382ff73d14eed7", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/a7f5d6ab88632b3b482fe10611382ff73d14eed7" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:16:06Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html" }, { "reference_url": "https://security.gentoo.org/glsa/202401-05", "reference_id": "", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:16:06Z/" } ], "url": "https://security.gentoo.org/glsa/202401-05" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210902-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210902-0004" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:16:06Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:16:06Z/" } ], "url": "https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980132", "reference_id": "1980132", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980132" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990815", "reference_id": "990815", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990815" }, { "reference_url": "https://security.archlinux.org/ASA-202107-18", "reference_id": "ASA-202107-18", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202107-18" }, { "reference_url": "https://security.archlinux.org/AVG-1901", "reference_id": "AVG-1901", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1901" }, { "reference_url": "https://security.archlinux.org/AVG-1905", "reference_id": "AVG-1905", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1905" }, { "reference_url": "https://security.archlinux.org/AVG-1906", "reference_id": "AVG-1906", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1906" }, { "reference_url": "https://security.archlinux.org/AVG-2125", "reference_id": "AVG-2125", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2125" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31799", "reference_id": "CVE-2021-31799", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31799" }, { "reference_url": "https://security-tracker.debian.org/tracker/CVE-2021-31799", "reference_id": "CVE-2021-31799", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:16:06Z/" } ], "url": "https://security-tracker.debian.org/tracker/CVE-2021-31799" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2021-31799.yml", "reference_id": "CVE-2021-31799.YML", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2021-31799.yml" }, { "reference_url": "https://github.com/advisories/GHSA-ggxm-pgc9-g7fp", "reference_id": "GHSA-ggxm-pgc9-g7fp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-ggxm-pgc9-g7fp" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3020", "reference_id": "RHSA-2021:3020", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3020" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3559", "reference_id": "RHSA-2021:3559", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3559" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3982", "reference_id": "RHSA-2021:3982", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3982" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0543", "reference_id": "RHSA-2022:0543", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0543" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0544", "reference_id": "RHSA-2022:0544", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0544" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0672", "reference_id": "RHSA-2022:0672", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0672" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0708", "reference_id": "RHSA-2022:0708", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0708" }, { "reference_url": "https://usn.ubuntu.com/5020-1/", "reference_id": "USN-5020-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5020-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938487?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-31799", "GHSA-ggxm-pgc9-g7fp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a1z8-2fdu-1uhd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/18132?format=api", "vulnerability_id": "VCID-ajtx-8w3u-rkae", "summary": "URI gem has ReDoS vulnerability\nA ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with `rfc2396_parser.rb` and `rfc3986_parser.rb`.\n\nNOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.\n\n[The Ruby advisory recommends](https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/) updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead:\n- For Ruby 3.0: Update to uri 0.10.3\n- For Ruby 3.1 and 3.2: Update to uri 0.12.2.\n\nYou can use gem update uri to update it. If you are using bundler, please add gem `uri`, `>= 0.12.2` (or other version mentioned above) to your Gemfile.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-36617.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-36617.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-36617", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76842", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76806", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76799", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76826", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76745", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76774", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76755", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76787", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00983", "scoring_system": "epss", "scoring_elements": "0.76797", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-36617" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36617", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36617" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/uri", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri" }, { "reference_url": "https://github.com/ruby/uri/commit/05b1e7d026b886e65a60ee35625229da9ec220bb", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/commit/05b1e7d026b886e65a60ee35625229da9ec220bb" }, { "reference_url": "https://github.com/ruby/uri/commit/38bf797c488bcb4a37fb322bfa84977981863ec6", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/commit/38bf797c488bcb4a37fb322bfa84977981863ec6" }, { "reference_url": "https://github.com/ruby/uri/commit/3cd938df20db26c9439e9f681aadfb9bbeb6d1c0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/commit/3cd938df20db26c9439e9f681aadfb9bbeb6d1c0" }, { "reference_url": "https://github.com/ruby/uri/commit/4d02315181d8a485496f1bb107a6ab51d6f3a35f", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/commit/4d02315181d8a485496f1bb107a6ab51d6f3a35f" }, { "reference_url": "https://github.com/ruby/uri/commit/70794abc162bb15bb934713b5669713d6700d35c", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/commit/70794abc162bb15bb934713b5669713d6700d35c" }, { "reference_url": "https://github.com/ruby/uri/commit/7e33934c91b7f8f3ea7b7a4258b468e19f636bc3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/commit/7e33934c91b7f8f3ea7b7a4258b468e19f636bc3" }, { "reference_url": "https://github.com/ruby/uri/commit/9a8e0cc03da964054c2a4ea26b59c53c3bae4921", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/commit/9a8e0cc03da964054c2a4ea26b59c53c3bae4921" }, { "reference_url": "https://github.com/ruby/uri/commit/ba36c8a3ecad8c16dd3e60a6da9abd768206c8fa", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/commit/ba36c8a3ecad8c16dd3e60a6da9abd768206c8fa" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20230725-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20230725-0002" }, { "reference_url": "https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218614", "reference_id": "2218614", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218614" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36617", "reference_id": "CVE-2023-36617", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36617" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2023-36617.yml", "reference_id": "CVE-2023-36617.YML", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2023-36617.yml" }, { "reference_url": "https://github.com/advisories/GHSA-hww2-5g85-429m", "reference_id": "GHSA-hww2-5g85-429m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hww2-5g85-429m" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:1431", "reference_id": "RHSA-2024:1431", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:1431" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:1576", "reference_id": "RHSA-2024:1576", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:1576" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:4499", "reference_id": "RHSA-2024:4499", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:4499" }, { "reference_url": "https://usn.ubuntu.com/6219-1/", "reference_id": "USN-6219-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6219-1/" }, { "reference_url": "https://usn.ubuntu.com/7747-1/", "reference_id": "USN-7747-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7747-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938488?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u2?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u2%3Fdistro=bullseye" } ], "aliases": [ "CVE-2023-36617", "GHSA-hww2-5g85-429m" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ajtx-8w3u-rkae" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/34891?format=api", "vulnerability_id": "VCID-bdar-wgfe-qqgf", "summary": "REXML round-trip instability\nThe REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28965.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28965.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-28965", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58339", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58306", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58332", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58349", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58326", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58273", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58298", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58278", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58193", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.58327", "published_at": "2026-04-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-28965" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml" }, { "reference_url": "https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b" }, { "reference_url": "https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377" }, { "reference_url": "https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752" }, { "reference_url": "https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e" }, { "reference_url": "https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8" }, { "reference_url": "https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551" }, { "reference_url": "https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2021-28965.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2021-28965.yml" }, { "reference_url": "https://hackerone.com/reports/1104077", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/1104077" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28965", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28965" }, { "reference_url": "https://rubygems.org/gems/rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://rubygems.org/gems/rexml" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210528-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210528-0003" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210528-0003/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20210528-0003/" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1947526", "reference_id": "1947526", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1947526" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986807", "reference_id": "986807", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986807" }, { "reference_url": "https://security.archlinux.org/ASA-202104-1", "reference_id": "ASA-202104-1", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202104-1" }, { "reference_url": "https://security.archlinux.org/AVG-1788", "reference_id": "AVG-1788", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1788" }, { "reference_url": "https://security.archlinux.org/AVG-1789", "reference_id": "AVG-1789", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1789" }, { "reference_url": "https://security.archlinux.org/AVG-1822", "reference_id": "AVG-1822", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1822" }, { "reference_url": "https://github.com/advisories/GHSA-8cr8-4vfw-mr7h", "reference_id": "GHSA-8cr8-4vfw-mr7h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8cr8-4vfw-mr7h" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2104", "reference_id": "RHSA-2021:2104", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2104" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2229", "reference_id": "RHSA-2021:2229", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2229" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2230", "reference_id": "RHSA-2021:2230", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2230" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2584", "reference_id": "RHSA-2021:2584", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2584" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2587", "reference_id": "RHSA-2021:2587", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2587" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2588", "reference_id": "RHSA-2021:2588", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2588" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://usn.ubuntu.com/4922-1/", "reference_id": "USN-4922-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4922-1/" }, { "reference_url": "https://usn.ubuntu.com/4922-2/", "reference_id": "USN-4922-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4922-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938486?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.3-1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.3-1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-28965", "GHSA-8cr8-4vfw-mr7h" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bdar-wgfe-qqgf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/19205?format=api", "vulnerability_id": "VCID-c5xq-bv4t-73ff", "summary": "REXML contains a denial of service vulnerability\n### Impact\n\nThe REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many `>`s in an attribute value.\n\nIf you need to parse untrusted XMLs, you may be impacted to this vulnerability.\n\n### Patches\n\nThe REXML gem 3.2.7 or later include the patch to fix this vulnerability.\n\n### Workarounds\n\nDon't parse untrusted XMLs.\n\n### References\n\n* https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-35176.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-35176.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-35176", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.06902", "scoring_system": "epss", "scoring_elements": "0.91418", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.06902", "scoring_system": "epss", "scoring_elements": "0.91393", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.06902", "scoring_system": "epss", "scoring_elements": "0.91391", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.06902", "scoring_system": "epss", "scoring_elements": "0.91384", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.06902", "scoring_system": "epss", "scoring_elements": "0.91377", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.06902", "scoring_system": "epss", "scoring_elements": "0.91358", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.06902", "scoring_system": "epss", "scoring_elements": "0.91365", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.06902", "scoring_system": "epss", "scoring_elements": "0.91347", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-35176" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35176", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35176" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml" }, { "reference_url": "https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-05-16T18:26:15Z/" } ], "url": "https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb" }, { "reference_url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-05-16T18:26:15Z/" } ], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35176", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35176" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20250306-0001", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20250306-0001" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-05-16T18:26:15Z/" } ], "url": "https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071626", "reference_id": "1071626", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1071626" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280894", "reference_id": "2280894", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280894" }, { "reference_url": "https://github.com/advisories/GHSA-vg3r-rm7w-2xgh", "reference_id": "GHSA-vg3r-rm7w-2xgh", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vg3r-rm7w-2xgh" }, { "reference_url": "https://security.gentoo.org/glsa/202507-08", "reference_id": "GLSA-202507-08", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202507-08" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:4499", "reference_id": "RHSA-2024:4499", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:4499" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:5338", "reference_id": "RHSA-2024:5338", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:5338" }, { "reference_url": "https://usn.ubuntu.com/7091-1/", "reference_id": "USN-7091-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-1/" }, { "reference_url": "https://usn.ubuntu.com/7091-2/", "reference_id": "USN-7091-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-2/" }, { "reference_url": "https://usn.ubuntu.com/7418-1/", "reference_id": "USN-7418-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7418-1/" }, { "reference_url": "https://usn.ubuntu.com/7734-1/", "reference_id": "USN-7734-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7734-1/" }, { "reference_url": "https://usn.ubuntu.com/7840-1/", "reference_id": "USN-7840-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7840-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938489?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u3?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u3%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-35176", "GHSA-vg3r-rm7w-2xgh" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-c5xq-bv4t-73ff" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/33523?format=api", "vulnerability_id": "VCID-d6tn-s1q2-a3hc", "summary": "Unsafe object creation in json RubyGem\nThe JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10663.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-10663.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-10663", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91817", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91815", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91812", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91805", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91792", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91784", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.9177", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91779", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91832", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.07526", "scoring_system": "epss", "scoring_elements": "0.91813", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-10663" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10663", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10663" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10933", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10933" }, { "reference_url": "http://seclists.org/fulldisclosure/2020/Dec/32", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2020/Dec/32" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/flori/json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/flori/json" }, { "reference_url": "https://github.com/flori/json/blob/master/CHANGES.md#2019-12-11-230", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/flori/json/blob/master/CHANGES.md#2019-12-11-230" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2020-10663.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2020-10663.yml" }, { "reference_url": "https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b@%3Cissues.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b@%3Cissues.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61@%3Cissues.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61@%3Cissues.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d@%3Cissues.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d@%3Cissues.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae@%3Cdev.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae@%3Cdev.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c@%3Cissues.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c@%3Cissues.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5@%3Cissues.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5@%3Cissues.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7@%3Cissues.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7@%3Cissues.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db@%3Cissues.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db@%3Cissues.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c@%3Cissues.zookeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c@%3Cissues.zookeeper.apache.org%3E" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10663", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10663" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210129-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210129-0003" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210129-0003/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20210129-0003/" }, { "reference_url": "https://support.apple.com/kb/HT211931", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT211931" }, { "reference_url": "https://www.debian.org/security/2020/dsa-4721", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2020/dsa-4721" }, { "reference_url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663" }, { "reference_url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1827500", "reference_id": "1827500", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1827500" }, { "reference_url": "https://github.com/advisories/GHSA-jphg-qwrw-7w9g", "reference_id": "GHSA-jphg-qwrw-7w9g", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jphg-qwrw-7w9g" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2462", "reference_id": "RHSA-2020:2462", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2462" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2473", "reference_id": "RHSA-2020:2473", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2473" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2670", "reference_id": "RHSA-2020:2670", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2670" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2104", "reference_id": "RHSA-2021:2104", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2104" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2230", "reference_id": "RHSA-2021:2230", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2230" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2587", "reference_id": "RHSA-2021:2587", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2587" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2588", "reference_id": "RHSA-2021:2588", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2588" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://usn.ubuntu.com/4882-1/", "reference_id": "USN-4882-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4882-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938483?format=api", "purl": "pkg:deb/debian/ruby2.7@0?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@0%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2020-10663", "GHSA-jphg-qwrw-7w9g" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-d6tn-s1q2-a3hc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/29268?format=api", "vulnerability_id": "VCID-exq5-cnrm-3uhd", "summary": "CGI has Denial of Service (DoS) potential in Cookie.parse\nThere is a possibility for DoS by in the cgi gem.\nThis vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.\n\n## Details\n\nCGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.\n\nPlease update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.\n\n## Affected versions\n\ncgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.\n\n## Credits\n\nThanks to lio346 for discovering this issue.\nAlso thanks to mame for fixing this vulnerability.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27219.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27219.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-27219", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00316", "scoring_system": "epss", "scoring_elements": "0.54661", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00316", "scoring_system": "epss", "scoring_elements": "0.54678", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00316", "scoring_system": "epss", "scoring_elements": "0.5464", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00349", "scoring_system": "epss", "scoring_elements": "0.57444", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00416", "scoring_system": "epss", "scoring_elements": "0.6169", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00416", "scoring_system": "epss", "scoring_elements": "0.61675", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00623", "scoring_system": "epss", "scoring_elements": "0.70084", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00778", "scoring_system": "epss", "scoring_elements": "0.73608", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00778", "scoring_system": "epss", "scoring_elements": "0.73631", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-27219" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27219", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27219" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/cgi", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi" }, { "reference_url": "https://github.com/ruby/cgi/pull/52", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/pull/52" }, { "reference_url": "https://github.com/ruby/cgi/pull/53", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/pull/53" }, { "reference_url": "https://github.com/ruby/cgi/pull/54", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/pull/54" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:41:05Z/" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml" }, { "reference_url": "https://hackerone.com/reports/2936778", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:41:05Z/" } ], "url": "https://hackerone.com/reports/2936778" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27219", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27219" }, { "reference_url": "https://www.cve.org/CVERecord?id=CVE-2025-27219", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.cve.org/CVERecord?id=CVE-2025-27219" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103792", "reference_id": "1103792", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103792" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349699", "reference_id": "2349699", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349699" }, { "reference_url": "https://github.com/advisories/GHSA-gh9q-2xrm-x6qv", "reference_id": "GHSA-gh9q-2xrm-x6qv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gh9q-2xrm-x6qv" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:10217", "reference_id": "RHSA-2025:10217", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:10217" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4063", "reference_id": "RHSA-2025:4063", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4063" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4487", "reference_id": "RHSA-2025:4487", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4487" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4488", "reference_id": "RHSA-2025:4488", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4488" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4493", "reference_id": "RHSA-2025:4493", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4493" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:8131", "reference_id": "RHSA-2025:8131", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:8131" }, { "reference_url": "https://usn.ubuntu.com/7418-1/", "reference_id": "USN-7418-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7418-1/" }, { "reference_url": "https://usn.ubuntu.com/7442-1/", "reference_id": "USN-7442-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7442-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938490?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u5%3Fdistro=bullseye" } ], "aliases": [ "CVE-2025-27219", "GHSA-gh9q-2xrm-x6qv" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-exq5-cnrm-3uhd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11806?format=api", "vulnerability_id": "VCID-gfjn-m9zp-57c5", "summary": "Duplicate\nThis advisory duplicates another.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41816.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41816.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41816", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63099", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63077", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.62977", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63036", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63064", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63029", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.6308", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63096", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00437", "scoring_system": "epss", "scoring_elements": "0.63113", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00483", "scoring_system": "epss", "scoring_elements": "0.6523", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41816" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41816", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41816" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819" }, { "reference_url": "https://github.com/ruby/cgi", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi" }, { "reference_url": "https://github.com/ruby/cgi/commit/959ccf0b6a672bcc64aeaa60c6e1f9e728f1e87f", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/commit/959ccf0b6a672bcc64aeaa60c6e1f9e728f1e87f" }, { "reference_url": "https://github.com/ruby/cgi/commit/ad079c1cb5f58eba1ffac46da79995fcf94a3a6e", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/commit/ad079c1cb5f58eba1ffac46da79995fcf94a3a6e" }, { "reference_url": "https://github.com/ruby/cgi/commit/c6a37a671b556eb06140ea89cc465136b24207a6", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/commit/c6a37a671b556eb06140ea89cc465136b24207a6" }, { "reference_url": "https://github.com/ruby/cgi/commit/c728632c1c09d46cfd4ecbff9caaa3651dd1002a", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/commit/c728632c1c09d46cfd4ecbff9caaa3651dd1002a" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-41816.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-41816.yml" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c" }, { "reference_url": "https://hackerone.com/reports/1328463", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/1328463" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "reference_url": "https://security.gentoo.org/glsa/202401-27", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202401-27" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220303-0006", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20220303-0006" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220303-0006/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20220303-0006/" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026752", "reference_id": "2026752", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026752" }, { "reference_url": "https://security.archlinux.org/AVG-2582", "reference_id": "AVG-2582", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2582" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41816", "reference_id": "CVE-2021-41816", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41816" }, { "reference_url": "https://security-tracker.debian.org/tracker/CVE-2021-41816", "reference_id": "CVE-2021-41816", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security-tracker.debian.org/tracker/CVE-2021-41816" }, { "reference_url": "https://github.com/advisories/GHSA-5cqm-crxm-6qpv", "reference_id": "GHSA-5cqm-crxm-6qpv", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5cqm-crxm-6qpv" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6855", "reference_id": "RHSA-2022:6855", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6855" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6856", "reference_id": "RHSA-2022:6856", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6856" }, { "reference_url": "https://usn.ubuntu.com/5235-1/", "reference_id": "USN-5235-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5235-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-41816", "GHSA-5cqm-crxm-6qpv", "GMS-2021-17" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gfjn-m9zp-57c5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/29298?format=api", "vulnerability_id": "VCID-h4mf-99f4-9bdw", "summary": "CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement\nThere is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem.\n\n## Details\n\nThe regular expression used in `CGI::Util#escapeElement` is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption.\n\nThis vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.\n\n## Affected versions\n\ncgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.\n\n## Credits\n\nThanks to svalkanov for discovering this issue.\nAlso thanks to nobu for fixing this vulnerability.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27220.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27220.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-27220", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00181", "scoring_system": "epss", "scoring_elements": "0.39855", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00181", "scoring_system": "epss", "scoring_elements": "0.39822", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00181", "scoring_system": "epss", "scoring_elements": "0.39805", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.002", "scoring_system": "epss", "scoring_elements": "0.42161", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00282", "scoring_system": "epss", "scoring_elements": "0.51609", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00282", "scoring_system": "epss", "scoring_elements": "0.51613", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00483", "scoring_system": "epss", "scoring_elements": "0.65173", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00566", "scoring_system": "epss", "scoring_elements": "0.68405", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00566", "scoring_system": "epss", "scoring_elements": "0.68425", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-27220" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27220", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27220" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/cgi", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi" }, { "reference_url": "https://github.com/ruby/cgi/pull/52", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/pull/52" }, { "reference_url": "https://github.com/ruby/cgi/pull/53", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/pull/53" }, { "reference_url": "https://github.com/ruby/cgi/pull/54", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/cgi/pull/54" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:39:36Z/" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml" }, { "reference_url": "https://hackerone.com/reports/2890322", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:39:36Z/" } ], "url": "https://hackerone.com/reports/2890322" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27220", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27220" }, { "reference_url": "https://www.cve.org/CVERecord?id=CVE-2025-27220", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.cve.org/CVERecord?id=CVE-2025-27220" }, { "reference_url": "https://www.ruby-lang.org/en/news/2025/02/26/security-advisories", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2025/02/26/security-advisories" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103793", "reference_id": "1103793", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103793" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349696", "reference_id": "2349696", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349696" }, { "reference_url": "https://github.com/advisories/GHSA-mhwm-jh88-3gjf", "reference_id": "GHSA-mhwm-jh88-3gjf", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mhwm-jh88-3gjf" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4063", "reference_id": "RHSA-2025:4063", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4063" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4487", "reference_id": "RHSA-2025:4487", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4487" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4488", "reference_id": "RHSA-2025:4488", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4488" }, { "reference_url": "https://usn.ubuntu.com/7418-1/", "reference_id": "USN-7418-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7418-1/" }, { "reference_url": "https://usn.ubuntu.com/7442-1/", "reference_id": "USN-7442-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7442-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938490?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u5%3Fdistro=bullseye" } ], "aliases": [ "CVE-2025-27220", "GHSA-mhwm-jh88-3gjf" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-h4mf-99f4-9bdw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16012?format=api", "vulnerability_id": "VCID-jdtw-bn8z-e3b6", "summary": "REXML denial of service vulnerability\n### Impact\n\nThe REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes.\n\nIf you need to parse untrusted XMLs with tree parser API like `REXML::Document.new`, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected.\n\n### Patches\n\nThe REXML gem 3.3.6 or later include the patch to fix the vulnerability.\n\n### Workarounds\n\nDon't parse untrusted XMLs with tree parser API.\n\n### References\n\n* https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-43398.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-43398.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-43398", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78402", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78373", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.7838", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78397", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78371", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78365", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78325", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78356", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78339", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-43398" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43398", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43398" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml" }, { "reference_url": "https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3" }, { "reference_url": "https://github.com/ruby/rexml/releases/tag/v3.3.6", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-22T14:43:15Z/" } ], "url": "https://github.com/ruby/rexml/releases/tag/v3.3.6" }, { "reference_url": "https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-22T14:43:15Z/" } ], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-43398.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-43398.yml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43398", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43398" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20250103-0006", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20250103-0006" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083190", "reference_id": "1083190", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083190" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307297", "reference_id": "2307297", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307297" }, { "reference_url": "https://github.com/advisories/GHSA-vmwr-mc7x-5vc3", "reference_id": "GHSA-vmwr-mc7x-5vc3", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vmwr-mc7x-5vc3" }, { "reference_url": "https://security.gentoo.org/glsa/202507-08", "reference_id": "GLSA-202507-08", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202507-08" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6670", "reference_id": "RHSA-2024:6670", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6670" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6702", "reference_id": "RHSA-2024:6702", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6702" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6703", "reference_id": "RHSA-2024:6703", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6703" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6784", "reference_id": "RHSA-2024:6784", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6784" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6785", "reference_id": "RHSA-2024:6785", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6785" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4063", "reference_id": "RHSA-2025:4063", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4063" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4488", "reference_id": "RHSA-2025:4488", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4488" }, { "reference_url": "https://usn.ubuntu.com/7256-1/", "reference_id": "USN-7256-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7256-1/" }, { "reference_url": "https://usn.ubuntu.com/7418-1/", "reference_id": "USN-7418-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7418-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938489?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u3?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u3%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-43398", "GHSA-vmwr-mc7x-5vc3" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jdtw-bn8z-e3b6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47062?format=api", "vulnerability_id": "VCID-jgyw-q58q-7qgm", "summary": "Tempfile on Windows path traversal vulnerability\nThere is an unintentional directory creation vulnerability in `tmpdir` library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-28966", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57255", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57281", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57302", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57322", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57309", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57307", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57173", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57254", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00347", "scoring_system": "epss", "scoring_elements": "0.57277", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-28966" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.yml" }, { "reference_url": "https://github.com/ruby/tmpdir", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/tmpdir" }, { "reference_url": "https://github.com/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f348", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f348" }, { "reference_url": "https://github.com/ruby/tmpdir/pull/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/tmpdir/pull/8" }, { "reference_url": "https://hackerone.com/reports/1131465", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/1131465" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28966", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28966" }, { "reference_url": "https://rubygems.org/gems/tmpdir", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://rubygems.org/gems/tmpdir" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210902-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210902-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210902-0004/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20210902-0004/" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966/" }, { "reference_url": "https://github.com/advisories/GHSA-46f2-3v63-3xrp", "reference_id": "GHSA-46f2-3v63-3xrp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-46f2-3v63-3xrp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938483?format=api", "purl": "pkg:deb/debian/ruby2.7@0?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@0%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-28966", "GHSA-46f2-3v63-3xrp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jgyw-q58q-7qgm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16840?format=api", "vulnerability_id": "VCID-m4a8-ya4v-tkgm", "summary": "RDoc RCE vulnerability with .rdoc_options\nAn issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.\n\nWhen parsing `.rdoc_options` (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.\n\nWhen loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.\n\nWe recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:\n\n* For Ruby 3.0 users: Update to `rdoc` 6.3.4.1\n* For Ruby 3.1 users: Update to `rdoc` 6.4.1.1\n* For Ruby 3.2 users: Update to `rdoc` 6.5.1.1\n\nYou can use `gem update rdoc` to update it. If you are using bundler, please add `gem \"rdoc\", \">= 6.6.3.1\"` to your `Gemfile`.\n\nNote: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27281.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27281.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-27281", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.85269", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.85249", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.85252", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.85231", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.8524", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.85254", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.8519", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.85208", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.02463", "scoring_system": "epss", "scoring_elements": "0.8521", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-27281" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27281", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27281" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rdoc", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc" }, { "reference_url": "https://github.com/ruby/rdoc/commit/1254b0066f312ddbf7fae7a195e66ce5b3bc6656", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/1254b0066f312ddbf7fae7a195e66ce5b3bc6656" }, { "reference_url": "https://github.com/ruby/rdoc/commit/32ff6ba0bebd8ea26f569da5fd23be2937f6a644", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/32ff6ba0bebd8ea26f569da5fd23be2937f6a644" }, { "reference_url": "https://github.com/ruby/rdoc/commit/48617985e9fbc2825219d55f04e3e0e98d2923be", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/48617985e9fbc2825219d55f04e3e0e98d2923be" }, { "reference_url": "https://github.com/ruby/rdoc/commit/811f125a4a0cc968e3eb18e16ea6c1a3b49a11bf", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/811f125a4a0cc968e3eb18e16ea6c1a3b49a11bf" }, { "reference_url": "https://github.com/ruby/rdoc/commit/a5de13bf0f0c26f8e764e82b5bf4bf8bffc7198e", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/a5de13bf0f0c26f8e764e82b5bf4bf8bffc7198e" }, { "reference_url": "https://github.com/ruby/rdoc/commit/d22ba930f1f611dda531dba04cd3d2531bb3f8a5", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/d22ba930f1f611dda531dba04cd3d2531bb3f8a5" }, { "reference_url": "https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d" }, { "reference_url": "https://github.com/ruby/rdoc/commit/e4a0e71e6f1032f8b4e5e58b4ef60d702c22ce17", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rdoc/commit/e4a0e71e6f1032f8b4e5e58b4ef60d702c22ce17" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2024-27281.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2024-27281.yml" }, { "reference_url": "https://hackerone.com/reports/1187477", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-20T13:50:49Z/" } ], "url": "https://hackerone.com/reports/1187477" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XYDHPHEZI7OQXTQKTDZHGZNPIJH7ZV5N", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XYDHPHEZI7OQXTQKTDZHGZNPIJH7ZV5N" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27281", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27281" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "2.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "4.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-20T13:50:49Z/" } ], "url": "https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067803", "reference_id": "1067803", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067803" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270749", "reference_id": "2270749", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270749" }, { "reference_url": "https://github.com/advisories/GHSA-592j-995h-p23j", "reference_id": "GHSA-592j-995h-p23j", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-592j-995h-p23j" }, { "reference_url": "https://security.gentoo.org/glsa/202406-03", "reference_id": "GLSA-202406-03", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202406-03" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3500", "reference_id": "RHSA-2024:3500", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3500" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3546", "reference_id": "RHSA-2024:3546", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3546" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3668", "reference_id": "RHSA-2024:3668", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3668" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3670", "reference_id": "RHSA-2024:3670", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3670" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3671", "reference_id": "RHSA-2024:3671", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3671" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3838", "reference_id": "RHSA-2024:3838", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3838" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:4499", "reference_id": "RHSA-2024:4499", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:4499" }, { "reference_url": "https://usn.ubuntu.com/6838-1/", "reference_id": "USN-6838-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6838-1/" }, { "reference_url": "https://usn.ubuntu.com/6838-2/", "reference_id": "USN-6838-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6838-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938488?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u2?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u2%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-27281", "GHSA-592j-995h-p23j" ], "risk_score": 2.0, "exploitability": "0.5", "weighted_severity": "4.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m4a8-ya4v-tkgm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16158?format=api", "vulnerability_id": "VCID-m6hy-vnf9-hyfe", "summary": "REXML DoS vulnerability\n### Impact\n\nThe REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API.\n\nIf you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability.\n\n### Patches\n\nThe REXML gem 3.3.3 or later include the patch to fix the vulnerability.\n\n### Workarounds\n\nDon't parse untrusted XMLs with SAX2 or pull parser API.\n\n### References\n\n* https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ : This is a similar vulnerability\n* https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/: An announce on www.ruby-lang.org", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41946.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41946.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-41946", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.71165", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.71119", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.71114", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.71135", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.7115", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.71127", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.71072", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.71097", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00661", "scoring_system": "epss", "scoring_elements": "0.7108", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-41946" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41946", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41946" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml" }, { "reference_url": "https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-01T15:45:10Z/" } ], "url": "https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368" }, { "reference_url": "https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-01T15:45:10Z/" } ], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-41946.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-41946.yml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41946", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41946" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20250117-0007", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20250117-0007" }, { "reference_url": "https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-01T15:45:10Z/" } ], "url": "https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-01T15:45:10Z/" } ], "url": "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083190", "reference_id": "1083190", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083190" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302272", "reference_id": "2302272", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302272" }, { "reference_url": "https://github.com/advisories/GHSA-5866-49gr-22v4", "reference_id": "GHSA-5866-49gr-22v4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5866-49gr-22v4" }, { "reference_url": "https://security.gentoo.org/glsa/202507-08", "reference_id": "GLSA-202507-08", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202507-08" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6670", "reference_id": "RHSA-2024:6670", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6670" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6702", "reference_id": "RHSA-2024:6702", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6702" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6703", "reference_id": "RHSA-2024:6703", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6703" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6784", "reference_id": "RHSA-2024:6784", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6784" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6785", "reference_id": "RHSA-2024:6785", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6785" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4063", "reference_id": "RHSA-2025:4063", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4063" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4488", "reference_id": "RHSA-2025:4488", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4488" }, { "reference_url": "https://usn.ubuntu.com/7091-1/", "reference_id": "USN-7091-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-1/" }, { "reference_url": "https://usn.ubuntu.com/7091-2/", "reference_id": "USN-7091-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-2/" }, { "reference_url": "https://usn.ubuntu.com/7840-1/", "reference_id": "USN-7840-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7840-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938489?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u3?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u3%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-41946", "GHSA-5866-49gr-22v4" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m6hy-vnf9-hyfe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11930?format=api", "vulnerability_id": "VCID-mkq9-21q7-6kg6", "summary": "Regular expression denial of service vulnerability (ReDoS) in date\nDate includes a ReDoS vulnerability.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41817.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41817.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41817", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65795", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65761", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65791", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65725", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65676", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65755", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65721", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65774", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65805", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00495", "scoring_system": "epss", "scoring_elements": "0.65784", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41817" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41816", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41816" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/date", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/date" }, { "reference_url": "https://github.com/ruby/date/commit/3959accef8da5c128f8a8e2fd54e932a4fb253b0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/date/commit/3959accef8da5c128f8a8e2fd54e932a4fb253b0" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/date/CVE-2021-41817.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/date/CVE-2021-41817.yml" }, { "reference_url": "https://hackerone.com/reports/1254844", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/1254844" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "reference_url": "https://security.gentoo.org/glsa/202401-27", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202401-27" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817" }, { "reference_url": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025104", "reference_id": "2025104", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025104" }, { "reference_url": "https://security.archlinux.org/AVG-2555", "reference_id": "AVG-2555", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2555" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41817", "reference_id": "CVE-2021-41817", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41817" }, { "reference_url": "https://github.com/advisories/GHSA-qg54-694p-wgpp", "reference_id": "GHSA-qg54-694p-wgpp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qg54-694p-wgpp" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0543", "reference_id": "RHSA-2022:0543", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0543" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0544", "reference_id": "RHSA-2022:0544", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0544" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0708", "reference_id": "RHSA-2022:0708", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0708" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:5779", "reference_id": "RHSA-2022:5779", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:5779" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6447", "reference_id": "RHSA-2022:6447", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6447" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6450", "reference_id": "RHSA-2022:6450", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6450" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6855", "reference_id": "RHSA-2022:6855", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6855" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6856", "reference_id": "RHSA-2022:6856", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6856" }, { "reference_url": "https://usn.ubuntu.com/5235-1/", "reference_id": "USN-5235-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5235-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-41817", "GHSA-qg54-694p-wgpp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mkq9-21q7-6kg6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12067?format=api", "vulnerability_id": "VCID-msc8-xjz2-2kb4", "summary": "REXML ReDoS vulnerability\n### Impact\n\nThe REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).\n\nThis does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.\n\n### Patches\n\nThe REXML gem 3.3.9 or later include the patch to fix the vulnerability.\n\n### Workarounds\n\nUse Ruby 3.2 or later instead of Ruby 3.1.\n\n### References\n\n* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-49761.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-49761.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-49761", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00899", "scoring_system": "epss", "scoring_elements": "0.75693", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00899", "scoring_system": "epss", "scoring_elements": "0.75661", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00899", "scoring_system": "epss", "scoring_elements": "0.7568", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00899", "scoring_system": "epss", "scoring_elements": "0.75655", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00899", "scoring_system": "epss", "scoring_elements": "0.75644", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00899", "scoring_system": "epss", "scoring_elements": "0.75599", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00899", "scoring_system": "epss", "scoring_elements": "0.7563", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00899", "scoring_system": "epss", "scoring_elements": "0.7561", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-49761" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49761", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49761" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml" }, { "reference_url": "https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-28T14:57:03Z/" } ], "url": "https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f" }, { "reference_url": "https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "6.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-28T14:57:03Z/" } ], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-49761.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-49761.yml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49761", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49761" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20241227-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20241227-0004" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-28T14:57:03Z/" } ], "url": "https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103790", "reference_id": "1103790", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103790" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322153", "reference_id": "2322153", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322153" }, { "reference_url": "https://github.com/advisories/GHSA-2rxp-v6pw-ch6m", "reference_id": "GHSA-2rxp-v6pw-ch6m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2rxp-v6pw-ch6m" }, { "reference_url": "https://security.gentoo.org/glsa/202507-08", "reference_id": "GLSA-202507-08", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202507-08" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10777", "reference_id": "RHSA-2024:10777", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10777" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10834", "reference_id": "RHSA-2024:10834", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10834" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10850", "reference_id": "RHSA-2024:10850", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10850" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10858", "reference_id": "RHSA-2024:10858", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10858" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10860", "reference_id": "RHSA-2024:10860", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10860" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10961", "reference_id": "RHSA-2024:10961", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10961" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10964", "reference_id": "RHSA-2024:10964", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10964" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10966", "reference_id": "RHSA-2024:10966", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10966" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10977", "reference_id": "RHSA-2024:10977", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10977" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10982", "reference_id": "RHSA-2024:10982", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10982" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:10984", "reference_id": "RHSA-2024:10984", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:10984" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:11001", "reference_id": "RHSA-2024:11001", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:11001" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:11027", "reference_id": "RHSA-2024:11027", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:11027" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:11028", "reference_id": "RHSA-2024:11028", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:11028" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:11029", "reference_id": "RHSA-2024:11029", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:11029" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:11047", "reference_id": "RHSA-2025:11047", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:11047" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:12499", "reference_id": "RHSA-2025:12499", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:12499" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:13269", "reference_id": "RHSA-2025:13269", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:13269" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:13307", "reference_id": "RHSA-2025:13307", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:13307" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:15124", "reference_id": "RHSA-2025:15124", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:15124" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:15371", "reference_id": "RHSA-2025:15371", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:15371" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:17614", "reference_id": "RHSA-2025:17614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:17614" }, { "reference_url": "https://usn.ubuntu.com/7091-1/", "reference_id": "USN-7091-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-1/" }, { "reference_url": "https://usn.ubuntu.com/7091-2/", "reference_id": "USN-7091-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-2/" }, { "reference_url": "https://usn.ubuntu.com/7442-1/", "reference_id": "USN-7442-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7442-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938489?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u3?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u3%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-49761", "GHSA-2rxp-v6pw-ch6m" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-msc8-xjz2-2kb4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/29314?format=api", "vulnerability_id": "VCID-n1ja-n53g-fycm", "summary": "URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+\nThere is a possibility for userinfo leakage by in the uri gem.\nThis vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.\n\n## Details\n\nThe methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.\n\nPlease update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.\n\n## Affected versions\n\nuri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.\n\n## Credits\n\nThanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.\nAlso thanks to nobu for additional fixes of this vulnerability.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27221.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27221.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-27221", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00038", "scoring_system": "epss", "scoring_elements": "0.1144", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00038", "scoring_system": "epss", "scoring_elements": "0.11384", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00118", "scoring_system": "epss", "scoring_elements": "0.30715", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33592", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33581", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33558", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35907", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00166", "scoring_system": "epss", "scoring_elements": "0.37709", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00166", "scoring_system": "epss", "scoring_elements": "0.37695", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-27221" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:38:46Z/" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml" }, { "reference_url": "https://github.com/ruby/uri", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri" }, { "reference_url": "https://github.com/ruby/uri/pull/154", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/pull/154" }, { "reference_url": "https://github.com/ruby/uri/pull/155", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/pull/155" }, { "reference_url": "https://github.com/ruby/uri/pull/156", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/pull/156" }, { "reference_url": "https://github.com/ruby/uri/pull/157", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/pull/157" }, { "reference_url": "https://hackerone.com/reports/2957667", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:38:46Z/" } ], "url": "https://hackerone.com/reports/2957667" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27221", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27221" }, { "reference_url": "https://www.cve.org/CVERecord?id=CVE-2025-27221", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.cve.org/CVERecord?id=CVE-2025-27221" }, { "reference_url": "https://www.ruby-lang.org/en/news/2025/02/26/security-advisories", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2025/02/26/security-advisories" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103794", "reference_id": "1103794", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103794" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349700", "reference_id": "2349700", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349700" }, { "reference_url": "https://github.com/advisories/GHSA-22h5-pq3x-2gf2", "reference_id": "GHSA-22h5-pq3x-2gf2", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-22h5-pq3x-2gf2" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:10217", "reference_id": "RHSA-2025:10217", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:10217" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4063", "reference_id": "RHSA-2025:4063", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4063" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4488", "reference_id": "RHSA-2025:4488", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4488" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4493", "reference_id": "RHSA-2025:4493", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4493" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:8131", "reference_id": "RHSA-2025:8131", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:8131" }, { "reference_url": "https://usn.ubuntu.com/7418-1/", "reference_id": "USN-7418-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7418-1/" }, { "reference_url": "https://usn.ubuntu.com/7442-1/", "reference_id": "USN-7442-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7442-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938490?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u5%3Fdistro=bullseye" } ], "aliases": [ "CVE-2025-27221", "GHSA-22h5-pq3x-2gf2" ], "risk_score": 1.6, "exploitability": "0.5", "weighted_severity": "3.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n1ja-n53g-fycm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/17971?format=api", "vulnerability_id": "VCID-qu1w-yd76-t7c1", "summary": "REXML denial of service vulnerability\n### Impact\n\nThe REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`.\n\nIf you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.\n\n### Patches\n\nThe REXML gem 3.3.2 or later include the patches to fix these vulnerabilities.\n\n### Workarounds\n\nDon't parse untrusted XMLs.\n\n### References\n\n* https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability\n* https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-39908.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-39908.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-39908", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.91261", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.91237", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.91238", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.91234", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.91227", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.91221", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.91207", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.912", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.06685", "scoring_system": "epss", "scoring_elements": "0.91192", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-39908" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39908", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39908" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml" }, { "reference_url": "https://github.com/ruby/rexml/releases/tag/v3.3.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml/releases/tag/v3.3.2" }, { "reference_url": "https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-16T17:58:11Z/" } ], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-39908.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-39908.yml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39908", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39908" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20250117-0008", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20250117-0008" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-16T17:58:11Z/" } ], "url": "https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076766", "reference_id": "1076766", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076766" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076768", "reference_id": "1076768", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076768" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298243", "reference_id": "2298243", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298243" }, { "reference_url": "https://github.com/advisories/GHSA-4xqq-m2hx-25v8", "reference_id": "GHSA-4xqq-m2hx-25v8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4xqq-m2hx-25v8" }, { "reference_url": "https://security.gentoo.org/glsa/202507-08", "reference_id": "GLSA-202507-08", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202507-08" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6784", "reference_id": "RHSA-2024:6784", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6784" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6785", "reference_id": "RHSA-2024:6785", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6785" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4063", "reference_id": "RHSA-2025:4063", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4063" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4488", "reference_id": "RHSA-2025:4488", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4488" }, { "reference_url": "https://usn.ubuntu.com/7091-1/", "reference_id": "USN-7091-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-1/" }, { "reference_url": "https://usn.ubuntu.com/7256-1/", "reference_id": "USN-7256-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7256-1/" }, { "reference_url": "https://usn.ubuntu.com/7418-1/", "reference_id": "USN-7418-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7418-1/" }, { "reference_url": "https://usn.ubuntu.com/7840-1/", "reference_id": "USN-7840-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7840-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938489?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u3?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u3%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-39908", "GHSA-4xqq-m2hx-25v8" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qu1w-yd76-t7c1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41899?format=api", "vulnerability_id": "VCID-qwh3-25yu-qfga", "summary": "Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28738.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-28738.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28738", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.58964", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.58949", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.5893", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.58902", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.58923", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.5889", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.58942", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.58948", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00371", "scoring_system": "epss", "scoring_elements": "0.58967", "published_at": "2026-04-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28738" }, { "reference_url": "https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2075685", "reference_id": "2075685", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2075685" }, { "reference_url": "https://security.archlinux.org/AVG-2757", "reference_id": "AVG-2757", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2757" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6450", "reference_id": "RHSA-2022:6450", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6450" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6585", "reference_id": "RHSA-2022:6585", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6585" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:6855", "reference_id": "RHSA-2022:6855", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:6855" }, { "reference_url": "https://usn.ubuntu.com/5462-1/", "reference_id": "USN-5462-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5462-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938483?format=api", "purl": "pkg:deb/debian/ruby2.7@0?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@0%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2022-28738", "GHSA-8pqg-8p79-j5j8" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qwh3-25yu-qfga" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41893?format=api", "vulnerability_id": "VCID-t9y5-hd9b-bkc4", "summary": "Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-31810.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-31810.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-31810", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70265", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.7037", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70316", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70331", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70354", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70339", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70326", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70277", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70295", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00632", "scoring_system": "epss", "scoring_elements": "0.70271", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-31810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31810", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31810" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014818", "reference_id": "1014818", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014818" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980126", "reference_id": "1980126", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980126" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990815", "reference_id": "990815", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990815" }, { "reference_url": "https://security.archlinux.org/ASA-202107-23", "reference_id": "ASA-202107-23", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202107-23" }, { "reference_url": "https://security.archlinux.org/AVG-1906", "reference_id": "AVG-1906", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1906" }, { "reference_url": "https://security.archlinux.org/AVG-2138", "reference_id": "AVG-2138", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2138" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3020", "reference_id": "RHSA-2021:3020", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3020" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3559", "reference_id": "RHSA-2021:3559", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3559" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3982", "reference_id": "RHSA-2021:3982", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3982" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0543", "reference_id": "RHSA-2022:0543", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0543" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0544", "reference_id": "RHSA-2022:0544", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0544" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0672", "reference_id": "RHSA-2022:0672", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0672" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0708", "reference_id": "RHSA-2022:0708", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0708" }, { "reference_url": "https://usn.ubuntu.com/5020-1/", "reference_id": "USN-5020-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5020-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938487?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-31810", "GHSA-wr95-679j-87v9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-t9y5-hd9b-bkc4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/17020?format=api", "vulnerability_id": "VCID-uxdx-abx7-fkdy", "summary": "Ruby URI component ReDoS issue\nA ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28755.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28755.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28755", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00322", "scoring_system": "epss", "scoring_elements": "0.55265", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00322", "scoring_system": "epss", "scoring_elements": "0.55283", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00322", "scoring_system": "epss", "scoring_elements": "0.55304", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00322", "scoring_system": "epss", "scoring_elements": "0.55292", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00322", "scoring_system": "epss", "scoring_elements": "0.55291", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00322", "scoring_system": "epss", "scoring_elements": "0.55241", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00322", "scoring_system": "epss", "scoring_elements": "0.55263", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00322", "scoring_system": "epss", "scoring_elements": "0.55239", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00357", "scoring_system": "epss", "scoring_elements": "0.57963", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-28755" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28755", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28755" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/uri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri" }, { "reference_url": "https://github.com/ruby/uri/releases", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/uri/releases" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z" }, { "reference_url": "https://security.gentoo.org/glsa/202401-27", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://security.gentoo.org/glsa/202401-27" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20230526-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20230526-0003" }, { "reference_url": "https://www.ruby-lang.org/en/downloads/releases", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/downloads/releases" }, { "reference_url": "https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released" }, { "reference_url": "https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036283", "reference_id": "1036283", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036283" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038408", "reference_id": "1038408", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038408" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184059", "reference_id": "2184059", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184059" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/", "reference_id": "27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28755", "reference_id": "CVE-2023-28755", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28755" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2023-28755.yml", "reference_id": "CVE-2023-28755.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2023-28755.yml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/", "reference_id": "FFZANOQA4RYX7XCB42OO3P24DQKWHEKA", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/", "reference_id": "G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/" }, { "reference_url": "https://github.com/advisories/GHSA-hv5j-3h9f-99c2", "reference_id": "GHSA-hv5j-3h9f-99c2", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hv5j-3h9f-99c2" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20230526-0003/", "reference_id": "ntap-20230526-0003", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20230526-0003/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/", "reference_id": "QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/" }, { "reference_url": "https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/", "reference_id": "redos-in-uri-cve-2023-28755", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/" }, { "reference_url": "https://github.com/ruby/uri/releases/", "reference_id": "releases", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://github.com/ruby/uri/releases/" }, { "reference_url": "https://www.ruby-lang.org/en/downloads/releases/", "reference_id": "releases", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://www.ruby-lang.org/en/downloads/releases/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3291", "reference_id": "RHSA-2023:3291", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3291" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3821", "reference_id": "RHSA-2023:3821", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3821" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:7025", "reference_id": "RHSA-2023:7025", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:7025" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:1431", "reference_id": "RHSA-2024:1431", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:1431" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:1576", "reference_id": "RHSA-2024:1576", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:1576" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3500", "reference_id": "RHSA-2024:3500", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3500" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3838", "reference_id": "RHSA-2024:3838", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3838" }, { "reference_url": "https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/", "reference_id": "ruby-3-2-0-released", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/" }, { "reference_url": "https://usn.ubuntu.com/6055-1/", "reference_id": "USN-6055-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6055-1/" }, { "reference_url": "https://usn.ubuntu.com/6055-2/", "reference_id": "USN-6055-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6055-2/" }, { "reference_url": "https://usn.ubuntu.com/6087-1/", "reference_id": "USN-6087-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6087-1/" }, { "reference_url": "https://usn.ubuntu.com/6181-1/", "reference_id": "USN-6181-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6181-1/" }, { "reference_url": "https://usn.ubuntu.com/6219-1/", "reference_id": "USN-6219-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6219-1/" }, { "reference_url": "https://usn.ubuntu.com/7735-1/", "reference_id": "USN-7735-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7735-1/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/", "reference_id": "WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-14T19:38:26Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938488?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u2?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u2%3Fdistro=bullseye" } ], "aliases": [ "CVE-2023-28755", "GHSA-hv5j-3h9f-99c2" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uxdx-abx7-fkdy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41892?format=api", "vulnerability_id": "VCID-vcz9-dvf4-47am", "summary": "Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-25613.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-25613.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-25613", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50623", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50581", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50595", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50618", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50575", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50487", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50579", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50524", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50544", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50571", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-25613" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25613", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25613" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2020-25613.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2020-25613.yml" }, { "reference_url": "https://github.com/ruby/webrick", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick" }, { "reference_url": "https://github.com/ruby/webrick/commit/076ac636bf48b7a492887ce4de7041de23e6c00d", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/076ac636bf48b7a492887ce4de7041de23e6c00d" }, { "reference_url": "https://github.com/ruby/webrick/commit/7618049fa57ddad2efff2a7bc7dad7d2d8a311b1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/7618049fa57ddad2efff2a7bc7dad7d2d8a311b1" }, { "reference_url": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7" }, { "reference_url": "https://github.com/ruby/webrick/commit/af2efdcdf826f25592202d187c53963e7932e4b9", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/webrick/commit/af2efdcdf826f25592202d187c53963e7932e4b9" }, { "reference_url": "https://hackerone.com/reports/965267", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/965267" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25613", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25613" }, { "reference_url": "https://security.gentoo.org/glsa/202401-27", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202401-27" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210115-0008", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210115-0008" }, { "reference_url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613" }, { "reference_url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883623", "reference_id": "1883623", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883623" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972230", "reference_id": "972230", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972230" }, { "reference_url": "https://github.com/advisories/GHSA-gwfg-cqmg-cf8f", "reference_id": "GHSA-gwfg-cqmg-cf8f", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gwfg-cqmg-cf8f" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2104", "reference_id": "RHSA-2021:2104", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2104" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2229", "reference_id": "RHSA-2021:2229", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2229" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2230", "reference_id": "RHSA-2021:2230", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2230" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2584", "reference_id": "RHSA-2021:2584", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2584" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2587", "reference_id": "RHSA-2021:2587", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2587" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2588", "reference_id": "RHSA-2021:2588", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2588" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://usn.ubuntu.com/4882-1/", "reference_id": "USN-4882-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4882-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938485?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.1-4?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.1-4%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2020-25613", "GHSA-gwfg-cqmg-cf8f" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vcz9-dvf4-47am" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/76720?format=api", "vulnerability_id": "VCID-x126-x9qm-e7d3", "summary": "ruby: Arbitrary memory address read vulnerability with Regex search", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27282.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-27282.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-27282", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.70057", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.69954", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.70002", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.70018", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.70042", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.70027", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.70013", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.69962", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00619", "scoring_system": "epss", "scoring_elements": "0.69977", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-27282" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27282", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27282" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-23T18:26:58Z/" } ], "url": "https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069969", "reference_id": "1069969", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069969" }, { "reference_url": "https://hackerone.com/reports/2122624", "reference_id": "2122624", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-23T18:26:58Z/" } ], "url": "https://hackerone.com/reports/2122624" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2276810", "reference_id": "2276810", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2276810" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3500", "reference_id": "RHSA-2024:3500", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3500" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3546", "reference_id": "RHSA-2024:3546", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3546" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3668", "reference_id": "RHSA-2024:3668", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3668" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3670", "reference_id": "RHSA-2024:3670", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3670" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3671", "reference_id": "RHSA-2024:3671", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3671" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:3838", "reference_id": "RHSA-2024:3838", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:3838" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:4499", "reference_id": "RHSA-2024:4499", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:4499" }, { "reference_url": "https://usn.ubuntu.com/6838-1/", "reference_id": "USN-6838-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6838-1/" }, { "reference_url": "https://usn.ubuntu.com/7734-1/", "reference_id": "USN-7734-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7734-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938488?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u2?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u2%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-27282", "GHSA-63cq-cj6g-qfr2" ], "risk_score": 3.0, "exploitability": "0.5", "weighted_severity": "5.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x126-x9qm-e7d3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41894?format=api", "vulnerability_id": "VCID-xkby-43zv-x3f7", "summary": "Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-32066.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-32066.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-32066", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22303", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22381", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22384", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22439", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.2246", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22419", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22364", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22468", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22514", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22302", "published_at": "2026-04-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-32066" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28965" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31799" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32066" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41819" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32066", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32066" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014818", "reference_id": "1014818", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014818" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980128", "reference_id": "1980128", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980128" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990815", "reference_id": "990815", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990815" }, { "reference_url": "https://security.archlinux.org/ASA-202107-23", "reference_id": "ASA-202107-23", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202107-23" }, { "reference_url": "https://security.archlinux.org/AVG-1906", "reference_id": "AVG-1906", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1906" }, { "reference_url": "https://security.archlinux.org/AVG-2138", "reference_id": "AVG-2138", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2138" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3020", "reference_id": "RHSA-2021:3020", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3020" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3559", "reference_id": "RHSA-2021:3559", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3559" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3982", "reference_id": "RHSA-2021:3982", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3982" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0543", "reference_id": "RHSA-2022:0543", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0543" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0544", "reference_id": "RHSA-2022:0544", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0544" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0581", "reference_id": "RHSA-2022:0581", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0581" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0582", "reference_id": "RHSA-2022:0582", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0582" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0672", "reference_id": "RHSA-2022:0672", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0672" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0708", "reference_id": "RHSA-2022:0708", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0708" }, { "reference_url": "https://usn.ubuntu.com/5020-1/", "reference_id": "USN-5020-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5020-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938487?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" } ], "aliases": [ "CVE-2021-32066", "GHSA-gx49-h5r3-q3xj" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xkby-43zv-x3f7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15969?format=api", "vulnerability_id": "VCID-yj1t-rga1-x3ev", "summary": "REXML DoS vulnerability\n### Impact\n\nThe REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`.\n\nIf you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.\n\n### Patches\n\nThe REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.\n\n### Workarounds\n\nDon't parse untrusted XMLs.\n\n### References\n\n* https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability\n* https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 : This is a similar vulnerability\n* https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/: An announce on www.ruby-lang.org", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41123.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41123.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-41123", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.46143", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.46088", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.46084", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.46079", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.46108", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.46086", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.4603", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.46082", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00232", "scoring_system": "epss", "scoring_elements": "0.46061", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-41123" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41123", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41123" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/ruby/rexml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ruby/rexml" }, { "reference_url": "https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-01T14:33:21Z/" } ], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8" }, { "reference_url": "https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-01T14:33:21Z/" } ], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6" }, { "reference_url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-01T14:33:21Z/" } ], "url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-41123.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-41123.yml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41123", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41123" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20241227-0005", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20241227-0005" }, { "reference_url": "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-01T14:33:21Z/" } ], "url": "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083190", "reference_id": "1083190", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083190" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302268", "reference_id": "2302268", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302268" }, { "reference_url": "https://github.com/advisories/GHSA-r55c-59qm-vjw6", "reference_id": "GHSA-r55c-59qm-vjw6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r55c-59qm-vjw6" }, { "reference_url": "https://security.gentoo.org/glsa/202507-08", "reference_id": "GLSA-202507-08", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202507-08" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6670", "reference_id": "RHSA-2024:6670", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6670" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6702", "reference_id": "RHSA-2024:6702", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6702" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6703", "reference_id": "RHSA-2024:6703", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6703" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6784", "reference_id": "RHSA-2024:6784", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6784" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:6785", "reference_id": "RHSA-2024:6785", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:6785" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4063", "reference_id": "RHSA-2025:4063", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4063" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2025:4488", "reference_id": "RHSA-2025:4488", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2025:4488" }, { "reference_url": "https://usn.ubuntu.com/7091-1/", "reference_id": "USN-7091-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-1/" }, { "reference_url": "https://usn.ubuntu.com/7091-2/", "reference_id": "USN-7091-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7091-2/" }, { "reference_url": "https://usn.ubuntu.com/7418-1/", "reference_id": "USN-7418-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7418-1/" }, { "reference_url": "https://usn.ubuntu.com/7840-1/", "reference_id": "USN-7840-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7840-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/938482?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/938489?format=api", "purl": "pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u3?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u3%3Fdistro=bullseye" } ], "aliases": [ "CVE-2024-41123", "GHSA-r55c-59qm-vjw6" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yj1t-rga1-x3ev" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye" }