CVE-2009-5147: Input Validation
DL::dlopen could open a library with tainted library name even if $SAFE > 0. This vulnerability affects Ruby versions 1.8, 1.9, 2.1, 2.2.
Upstream patch: https://github.com/ruby/ruby/commit/4600cf725a86ce31266153647ae5aa1197b1215b
Additional information and CVE assignment:
http://seclists.org/oss-sec/2015/q3/222
Other sources
DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5147?
CVE-2009-5147 has a severity rating that can vary based on the specific context of use within affected Ruby versions, typically categorized as moderate due to potential security implications.
How do I fix CVE-2009-5147?
To fix CVE-2009-5147, upgrade Ruby to version 2.1.8 or later, or to the patched versions specifically listed for your distribution.
What versions of Ruby are affected by CVE-2009-5147?
CVE-2009-5147 affects Ruby versions 1.8, 1.9, 2.0, 2.1, and 2.2.
Is my application vulnerable to CVE-2009-5147?
If your application uses Ruby versions 1.8, 1.9, or 2.0, it is likely vulnerable to CVE-2009-5147 unless patched.
What could happen if CVE-2009-5147 is exploited?
Exploitation of CVE-2009-5147 could allow an attacker to load arbitrary libraries, potentially executing malicious code within the Ruby application.