ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | all versions | |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 6 | — | |
| Red Hat | Red Hat Enterprise Linux 7 | — | |
| Red Hat | Red Hat Enterprise Linux 8 | all versions | |
| Red Hat | Red Hat Enterprise Linux 9 | all versions | |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | all versions | |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | all versions | |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | all versions | |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | all versions | |
| Red Hat | Red Hat Hardened Images | — | |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | |
| ruby | erb | < 4.0.3.1, = 4.0.4, >= 5.0.0, < 6.0.1.1, >= 6.0.2, < 6.0.4 |
Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.
