CVE-2021-28966
Fixed in a distro release EPSS 58%
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
Products: ruby-lang ruby
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | tmpdir | 0.1.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | ruby | 2.5.9-r0 |
| Alpine 3.11 | ruby | 2.6.7-r0 |
| Alpine 3.12 | ruby | 2.7.3-r0 |
| Alpine 3.13 | ruby | 2.7.3-r0 |
| Alpine 3.14 | ruby | 2.7.3-r0 |
| Alpine 3.15 | ruby | 2.7.3-r0 |
| Alpine 3.16 | ruby | 2.7.3-r0 |
| Alpine 3.17 | ruby | 2.7.3-r0 |
| Alpine 3.18 | ruby | 2.7.3-r0 |
| Alpine 3.19 | ruby | 2.7.3-r0 |
| Alpine 3.20 | ruby | 2.7.3-r0 |
| Alpine 3.21 | ruby | 2.7.3-r0 |
| Alpine 3.22 | ruby | 2.7.3-r0 |
| Alpine 3.23 | ruby | 2.7.3-r0 |
| Alpine 3.24 | ruby | 2.7.3-r0 |