CVE-2018-16396: High severity ruby-lang Ruby vulnerability
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
Other sources
Array#pack method converts the receiver’s contents into a string with specified format. If the receiver contains some tainted objects, the returned string also should be tainted. String#unpack method which converts the receiver into an array also should propagate its tainted flag to the objects contained in the returned array. But, with B, b, H and h directives, the tainted flags are not propagated. So, if a script processes unreliable inputs by Array#pack and/or String#unpack with these directives and checks the reliability with tainted flags, the check might be wrong.
External References:
https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-16396?
CVE-2018-16396 is a vulnerability discovered in Ruby before version 2.6.0-preview3 that does not taint strings that result from unpacking tainted strings with some formats.
What is the severity of CVE-2018-16396?
The severity of CVE-2018-16396 is high, with a CVSS score of 8.1.
Which versions of Ruby are affected by CVE-2018-16396?
Versions before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3 are affected by CVE-2018-16396.
How do I fix CVE-2018-16396 on Ubuntu?
If you're on Ubuntu, upgrade to the corresponding fixed version for your release: 2.0.0.484-1ubuntu2.11 (Trusty), 2.3.1-2~16.04.11 (Xenial), 2.5.1-1ubuntu1.1 (Bionic), or 2.5.1-5ubuntu4.1 (Cosmic).
Where can I find more information about CVE-2018-16396?
You can find more information about CVE-2018-16396 at the following references: [Debian Security Tracker](https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html), [HackerOne](https://hackerone.com/reports/385070), [Ruby-lang website](https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/).