Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Ruby 安全限制绕过漏洞
Vulnerability Description
Ruby是一种功能强大的面向对象的脚本语言。 R多个Ruby版本(1.8.5及之前版本、1.86至1.8.6-p286、1.8.7至1.8.7-p71、1.9至1.9 r18423)中的dl模块存在绕过安全限制漏洞。 由于没有在各安全等级没有正确处理关键变量及方法，安全等级限制的实现中存在多个错误。 攻击者可通过untrace_var；$PROGRAM_NAME；在第4级进行syslog操作；或在1到3级调用不安全的方式，绕过安全限制。
CVSS Information
N/A
Vulnerability Type
N/A