Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

ruby-mysql

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5RubyGemsPublished

    Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql

    CVE-2021-3779 · GHSA-73pr-g6jj-5hc9

    Affected
    • RubyGems ruby-mysql < 2.10.0
    Fixed in
    2.10.0· Vendor fix available
    Issue
    A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. In these cases, the server has the option to create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide additional data from a local file readable by the client (and not a "local" file on the server).

    Recommended action: Upgrade to 2.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →