Description
The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ruby +8 | 1.8.7.299-7.el6_1.1 | RHSA-2011:0910 |
| RHEL 5 | ruby +8 | 1.8.5-19.el5_6.1 | RHSA-2011:0909 |
| RHEL 4 | irb +6 | 1.8.1-16.el4 | RHSA-2011:0908 |
Advisories 3
- RHSA-2011:0910 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0908 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0909 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · May 9, 2026
References
- RHSA-2011:0910 vendor-advisory
- [oss-security] 20110221 Re: CVE request: ruby: FileUtils is vulnerable to symlink race attacks + Exception methods can bypass $SAFE mailing-list
- MDVSA-2011:098 vendor-advisory
- ADV-2011-0539 vdb-entry
- RHSA-2011:0909 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=678920
- 43573 third-party-advisory
- [oss-security] 20110221 CVE request: ruby: FileUtils is vulnerable to symlink race attacks + Exception methods can bypass $SAFE mailing-list
- RHSA-2011:0908 vendor-advisory
- 70957 vdb-entry
- FEDORA-2011-1876 vendor-advisory
- FEDORA-2011-1913 vendor-advisory
- 46458 vdb-entry
- http://support.apple.com/kb/HT5281
- MDVSA-2011:097 vendor-advisory
- APPLE-SA-2012-05-09-1 vendor-advisory
- 43420 third-party-advisory
- http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/