Lucene search

[email protected]CVE-2009-5147

HistoryMar 29, 2017 - 2:59 p.m.

CVE-2009-5147

2017-03-2914:59:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2009-5147

nvd

ruby

security vulnerability

code execution

tainted library names

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

7.1

Confidence

High

EPSS

0.008

Percentile

81.3%

JSON

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.

Affected configurations

NVD

Node

ruby-langrubyMatch1.8.0

ruby-langrubyMatch1.9.0

ruby-langrubyMatch1.9.2

ruby-langrubyMatch1.9.3

ruby-langrubyMatch2.0.0

ruby-langrubyMatch2.0.0p195

ruby-langrubyMatch2.0.0p247

ruby-langrubyMatch2.0.0p353

ruby-langrubyMatch2.0.0p481

ruby-langrubyMatch2.0.0p576

ruby-langrubyMatch2.0.0p594

ruby-langrubyMatch2.0.0p598

ruby-langrubyMatch2.0.0p643

ruby-langrubyMatch2.0.0p645

ruby-langrubyMatch2.0.0p647

ruby-langrubyMatch2.1.0

ruby-langrubyMatch2.1.1

ruby-langrubyMatch2.1.2

ruby-langrubyMatch2.1.3

ruby-langrubyMatch2.1.4

ruby-langrubyMatch2.1.5

ruby-langrubyMatch2.1.6

ruby-langrubyMatch2.1.7

VendorProductVersionCPE
ruby-langruby2.0.0cpe:/a:ruby-lang:ruby:2.0.0:p598::
ruby-langruby2.1.1cpe:/a:ruby-lang:ruby:2.1.1:::
ruby-langruby1.8.0cpe:/a:ruby-lang:ruby:1.8.0:::
ruby-langruby2.0.0cpe:/a:ruby-lang:ruby:2.0.0:p647::
ruby-langruby2.1.5cpe:/a:ruby-lang:ruby:2.1.5:::
ruby-langruby2.0.0cpe:/a:ruby-lang:ruby:2.0.0:p247::
ruby-langruby1.9.0cpe:/a:ruby-lang:ruby:1.9.0:::
ruby-langruby2.0.0cpe:/a:ruby-lang:ruby:2.0.0:p195::
ruby-langruby2.1.7cpe:/a:ruby-lang:ruby:2.1.7:::
ruby-langruby1.9.2cpe:/a:ruby-lang:ruby:1.9.2:::

Vendor	Product	Version	CPE
ruby-lang	ruby	2.0.0	cpe:/a:ruby-lang:ruby:2.0.0:p598::
ruby-lang	ruby	2.1.1	cpe:/a:ruby-lang:ruby:2.1.1:::
ruby-lang	ruby	1.8.0	cpe:/a:ruby-lang:ruby:1.8.0:::
ruby-lang	ruby	2.0.0	cpe:/a:ruby-lang:ruby:2.0.0:p647::
ruby-lang	ruby	2.1.5	cpe:/a:ruby-lang:ruby:2.1.5:::
ruby-lang	ruby	2.0.0	cpe:/a:ruby-lang:ruby:2.0.0:p247::
ruby-lang	ruby	1.9.0	cpe:/a:ruby-lang:ruby:1.9.0:::
ruby-lang	ruby	2.0.0	cpe:/a:ruby-lang:ruby:2.0.0:p195::
ruby-lang	ruby	2.1.7	cpe:/a:ruby-lang:ruby:2.1.7:::
ruby-lang	ruby	1.9.2	cpe:/a:ruby-lang:ruby:1.9.2:::