Read the docs
TI-2012-03808 Aliases CVE-2012-4466GHSA-gm9g-777x-3fp6

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision…

Priority LOW 28CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.

Summary

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.

Why it matters now

EPSS 0.02619 85th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:1.8.7:*:*:*:*:*:*:*1.8.7Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p160:*:*:*:*:*:*1.8.7 p160Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p17:*:*:*:*:*:*1.8.7 p17Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p173:*:*:*:*:*:*1.8.7 p173Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p174:*:*:*:*:*:*1.8.7 p174Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p22:*:*:*:*:*:*1.8.7 p22Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p248:*:*:*:*:*:*1.8.7 p248Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p249:*:*:*:*:*:*1.8.7 p249Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p299:*:*:*:*:*:*1.8.7 p299Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p301:*:*:*:*:*:*1.8.7 p301Vulnerableruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:*:*:*:*:*:*:* Versions 1.8.7 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p160:*:*:*:*:*:* Versions 1.8.7 p160 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p17:*:*:*:*:*:* Versions 1.8.7 p17 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p173:*:*:*:*:*:* Versions 1.8.7 p173 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p174:*:*:*:*:*:* Versions 1.8.7 p174 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p22:*:*:*:*:*:* Versions 1.8.7 p22 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p248:*:*:*:*:*:* Versions 1.8.7 p248 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p249:*:*:*:*:*:* Versions 1.8.7 p249 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p299:*:*:*:*:*:* Versions 1.8.7 p299 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p301:*:*:*:*:*:* Versions 1.8.7 p301 Vulnerable ·ruby
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:1.8.7:p302:*:*:*:*:*:*1.8.7 p302Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p330:*:*:*:*:*:*1.8.7 p330Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p334:*:*:*:*:*:*1.8.7 p334Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p352:*:*:*:*:*:*1.8.7 p352Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p357:*:*:*:*:*:*1.8.7 p357Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p358:*:*:*:*:*:*1.8.7 p358Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p370:*:*:*:*:*:*1.8.7 p370Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p71:*:*:*:*:*:*1.8.7 p71Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p72:*:*:*:*:*:*1.8.7 p72Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:preview1:*:*:*:*:*:*1.8.7 preview1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:preview2:*:*:*:*:*:*1.8.7 preview2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:preview3:*:*:*:*:*:*1.8.7 preview3Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:preview4:*:*:*:*:*:*1.8.7 preview4Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*1.9.3Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*1.9.3 p0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*1.9.3 p125Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*1.9.3 p194Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:*2.0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*2.0.0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*2.0.0 p0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:preview1:*:*:*:*:*:*2.0.0 preview1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:preview2:*:*:*:*:*:*2.0.0 preview2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2Vulnerableruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p302:*:*:*:*:*:* Versions 1.8.7 p302 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p330:*:*:*:*:*:* Versions 1.8.7 p330 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p334:*:*:*:*:*:* Versions 1.8.7 p334 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p352:*:*:*:*:*:* Versions 1.8.7 p352 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p357:*:*:*:*:*:* Versions 1.8.7 p357 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p358:*:*:*:*:*:* Versions 1.8.7 p358 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p370:*:*:*:*:*:* Versions 1.8.7 p370 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p71:*:*:*:*:*:* Versions 1.8.7 p71 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p72:*:*:*:*:*:* Versions 1.8.7 p72 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:preview1:*:*:*:*:*:* Versions 1.8.7 preview1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:preview2:*:*:*:*:*:* Versions 1.8.7 preview2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:preview3:*:*:*:*:*:* Versions 1.8.7 preview3 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:preview4:*:*:*:*:*:* Versions 1.8.7 preview4 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:* Versions 1.9.3 p0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:* Versions 1.9.3 p125 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:* Versions 1.9.3 p194 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:* Versions 2.0.0 p0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:preview1:*:*:*:*:*:* Versions 2.0.0 preview1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:preview2:*:*:*:*:*:* Versions 2.0.0 preview2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·ruby

Remediation

Red Hat 1 advisory

  • RHSA-2013:0582 Released 2013-02-28 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise 1.1.1 update
    • Red Hat OpenShift Enterprise Infrastructure graphviz-2.26.0-10.el6, graphviz-devel-2.26.0-10.el6, graphviz-doc-2.26.0-10.el6 +42
    • Red Hat OpenShift Enterprise JBoss EAP add-on openshift-origin-cartridge-jbosseap-6.0-1.0.4-1.el6op
    • Red Hat OpenShift Enterprise Node openshift-origin-cartridge-cron-1.4-1.0.3-1.el6op, openshift-origin-cartridge-diy-0.1-1.0.3-1.el6op, openshift-origin-cartridge-haproxy-1.4-1.0.4-1.el6op +46

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Enterprise InfrastructureFixed RHSA-2013:0582
Red Hat OpenShift Enterprise JBoss EAP add-onFixed RHSA-2013:0582
Red Hat OpenShift Enterprise NodeFixed RHSA-2013:0582
Not affected: 2 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-4466
  2. 2026-10-03 Alias added: GHSA-gm9g-777x-3fp6

References

Advisory 4

Other 5

  • TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
  • TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
  • TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
  • TI-2013-03637 Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1… CVSS 2.0MEDIUM 6.8
  • TI-2018-11751 An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5… CVSS 3.0CRITICAL 9.8
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences