CVE-2018-16396

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-16 · updated 2026-06-17

Description

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
Debian Linux: 8.0, 9.0
Red Hat Enterprise Linux: 6.0, 7.0, 7.4, 7.5, 7.6
Ruby: from 2.3.0 through 2.3.7; from 2.4.0 through 2.4.4; from 2.5.0 through 2.5.1; 2.6.0-preview1, 2.6.0-preview2

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
http://www.securitytracker.com/id/1042106
https://access.redhat.com/errata/RHSA-2018:3729
https://access.redhat.com/errata/RHSA-2018:3730
https://access.redhat.com/errata/RHSA-2018:3731
https://access.redhat.com/errata/RHSA-2019:2028
https://hackerone.com/reports/385070
https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html
https://security.netapp.com/advisory/ntap-20190221-0002/
https://usn.ubuntu.com/3808-1/
https://www.debian.org/security/2018/dsa-4332
https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/

Get alerted when CVE-2018-16396 or the next vulnerability affects your stack