Description
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | ruby1.9.1 | 1.9.2.0-2+deb6u4 | DLA-235-1 |
Advisories 1
- DLA-235-1 ruby1.9.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://puppet.com/security/cve/cve-2013-2065
- FEDORA-2013-8411 vendor-advisory
- USN-2035-1 vendor-advisory
- https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/
- FEDORA-2013-8375 vendor-advisory
- openSUSE-SU-2013:1611 vendor-advisory
- FEDORA-2013-8738 vendor-advisory