CVE-2008-3657: ruby-lang ruby Improper Input Validation

CVSS: 7.5v2.0HighModified

Published 13-08-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-3657 is a high (CVSS 7.5) Improper Input Validation vulnerability in ruby-lang ruby. EPSS estimates a 13.67% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

43/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

13.67%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 6

DSA-1651-1 DSA-1652-1 RHSA-2008:0897 RHSA-2026:7305 RHSA-2026:7307 RHSA-2026:8838

Timeline

13-08-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

13.67%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 13.67% on 19-09-2026

19-09-202619-10-2026

EPSS score

13.67%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databaseremotemultipleVerified
Ruby 1.9 dl - Module DL.dlopen Arbitrary Library Access
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Ruby-lang1 product

ruby≤ 1.8.5 | 1.6.8 | 1.8.0 | 1.8.1 | 1.8.1:-9 | 1.8.2 | 1.8.2:preview2 | 1.8.2:preview3 | 1.8.2:preview4 | 1.8.3 | 1.8.3:preview1 | 1.8.3:preview2 | 1.8.3:preview3 | 1.8.4 | 1.8.4:preview1 | 1.8.4:preview2 | 1.8.4:preview3 | 1.8.5:p11 | 1.8.5:p113 | 1.8.5:p115 | 1.8.5:p12 | 1.8.5:p2 | 1.8.5:p35 | 1.8.5:preview1 | 1.8.5:preview2 | 1.8.5:preview3 | 1.8.5:preview4 | 1.8.5:preview5 | 1.8.6 | 1.8.6:p110 | 1.8.6:p114 | 1.8.6:preview1 | 1.8.6:preview2 | 1.8.6:preview3 | 1.8.7 | 1.8.7:p17 | 1.8.7:p22 | 1.8.7:p71 | 1.8.7:preview1 | 1.8.7:preview2 | 1.8.7:preview3 | 1.8.7:preview4 | 1.9.0

1 vendor · 1 product

References

30 links

secunia.com/advisories/31430Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/31697Third Party AdvisoryX Refsource SECUNIAVendor Advisory
usn.ubuntu.com/651-1/Vendor AdvisoryX Refsource UBUNTU
support.apple.com/kb/HT3549X Refsource CONFIRM
wiki.rpath.com/wiki/Advisories:rPSA-2008-0264X Refsource CONFIRM
www.debian.org/security/2008/dsa-1652Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2008-October/msg00299.htmlVendor AdvisoryX Refsource FEDORA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9793VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/35074Third Party AdvisoryX Refsource SECUNIAVendor Advisory
support.avaya.com/elmodocs2/security/ASA-2008-424.htmX Refsource CONFIRM

Show all 30 references

www.debian.org/security/2008/dsa-1651Vendor AdvisoryX Refsource DEBIAN
lists.apple.com/archives/security-announce/2009/May/msg00002.htmlVendor AdvisoryX Refsource APPLE
www.securityfocus.com/bid/30644VDB EntryX Refsource BIDExploitPatch
www.redhat.com/support/errata/RHSA-2008-0897.htmlVendor AdvisoryX Refsource REDHAT
www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/X Refsource CONFIRM
secunia.com/advisories/32219Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
exchange.xforce.ibmcloud.com/vulnerabilities/44372VDB EntryX Refsource XF
secunia.com/advisories/32255Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2009/1297VDB EntryX Refsource VUPENVendor Advisory
www.securityfocus.com/archive/1/495884/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/32371Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/32165Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security.gentoo.org/glsa/glsa-200812-17.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/33178Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/2334VDB EntryX Refsource VUPENVendor Advisory
www.securitytracker.com/id?1020652VDB EntryX Refsource SECTRACK
www.redhat.com/archives/fedora-package-announce/2008-October/msg00259.htmlVendor AdvisoryX Refsource FEDORA
bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401X Refsource CONFIRM
secunia.com/advisories/32256Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities