Описание
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak can occur.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 9 | ruby-30 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | ruby-31 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | ruby-33 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | ruby | Fixed | RHSA-2025:8131 | 26.05.2025 |
| Red Hat Enterprise Linux 8 | ruby | Fixed | RHSA-2025:4063 | 23.04.2025 |
| Red Hat Enterprise Linux 9 | ruby | Fixed | RHSA-2025:4488 | 06.05.2025 |
| Red Hat Enterprise Linux 9 | ruby | Fixed | RHSA-2025:4493 | 06.05.2025 |
Показывать по
Дополнительная информация
Статус:
3.2 Low
CVSS3
Связанные уязвимости
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.jo ...
3.2 Low
CVSS3