# CVE-2019-16201: ruby: Ruby is an extensible, interpreted, object-oriented, scripting language

CVE-2019-16201 is fixed in 35 products on 1 platform, first by libruby2.5 2.5.1-1ubuntu1.6, released November 19, 2019. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2019-16201
- Priority: High
- CVSS: 7.5 (Moderate)
- EPSS: 0.0509
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 19, 2019

## Description

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)  Security Fix(es):  * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)  * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)  * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)  * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)  * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)  * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)  * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)  * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)  * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  Bug Fix(es):  * Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [rhel-8] (BZ#1954968)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libruby2.5 Ubuntu 18.04.6 LTS (bionic) | 2.5.1-1ubuntu1.6 | [libruby2.5 2.5.1-1ubuntu1.6](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libruby2.5-2.5.1-1ubuntu1.6.md) | Nov 19, 2019 |
| Linux | ruby RHEL 8 | 0:2.6.7-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | ruby ol 8 | 0:2.6.7-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | ruby-devel RHEL 8 | 0:2.6.7-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | ruby-devel ol 8 | 0:2.6.7-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | ruby-doc RHEL 8 | 0:2.6.7-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | ruby-doc ol 8 | 0:2.6.7-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | ruby-irb RHEL 8 | 0:2.5.9-107.module+el8.4.0+10822+fe4fffb1 | [RHSA-2021:2587](https://patchblox.com/security/data/fix/linux/rhsa-2021-2587.md) | Jun 29, 2021 |
| Linux | ruby-irb ol 8 | 0:2.5.9-107.module+el8.4.0+20203+c00aa653 | [ELSA-2021-2587](https://patchblox.com/security/data/fix/linux/elsa-2021-2587.md) | Jul 2, 2021 |
| Linux | ruby-libs RHEL 8 | 0:2.6.7-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | ruby-libs ol 8 | 0:2.6.7-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | ruby2.5 Ubuntu 18.04.6 LTS (bionic) | 2.5.1-1ubuntu1.6 | [ruby2.5 2.5.1-1ubuntu1.6](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-ruby2.5-2.5.1-1ubuntu1.6.md) | Nov 19, 2019 |
| Linux | rubygem-abrt RHEL 8 | 0:0.3.0-4.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-abrt ol 8 | 0:0.3.0-4.module+el8.1.0+5406+ce01f9b9 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-abrt-doc RHEL 8 | 0:0.3.0-4.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-abrt-doc ol 8 | 0:0.3.0-4.module+el8.1.0+5406+ce01f9b9 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-bigdecimal RHEL 8 | 0:1.4.1-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-bigdecimal ol 8 | 0:1.4.1-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-bson RHEL 8 | 0:4.5.0-1.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-bson ol 8 | 0:4.5.0-1.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-bson-doc RHEL 8 | 0:4.5.0-1.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-bson-doc ol 8 | 0:4.5.0-1.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-bundler RHEL 8 | 0:1.17.2-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-bundler ol 8 | 0:1.17.2-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-bundler-doc RHEL 8 | 0:1.16.1-3.module+el8.1.0+3656+f80bfa1d | [RHSA-2021:2587](https://patchblox.com/security/data/fix/linux/rhsa-2021-2587.md) | Jun 29, 2021 |
| Linux | rubygem-bundler-doc ol 8 | 0:1.16.1-3.module+el8.3.0+7756+e45777e9 | [ELSA-2021-2587](https://patchblox.com/security/data/fix/linux/elsa-2021-2587.md) | Jul 2, 2021 |
| Linux | rubygem-did_you_mean RHEL 8 | 0:1.3.0-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-did_you_mean ol 8 | 0:1.3.0-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-io-console RHEL 8 | 0:0.4.7-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-io-console ol 8 | 0:0.4.7-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-irb RHEL 8 | 0:1.0.0-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-irb ol 8 | 0:1.0.0-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-json RHEL 8 | 0:2.1.0-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-json ol 8 | 0:2.1.0-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-minitest RHEL 8 | 0:5.11.3-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-minitest ol 8 | 0:5.11.3-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-mongo RHEL 8 | 0:2.8.0-1.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-mongo ol 8 | 0:2.8.0-1.module+el8.1.0+5406+ce01f9b9 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-mongo-doc RHEL 8 | 0:2.8.0-1.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-mongo-doc ol 8 | 0:2.8.0-1.module+el8.1.0+5406+ce01f9b9 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-mysql2 RHEL 8 | 0:0.5.2-1.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-mysql2 ol 8 | 0:0.5.2-1.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-mysql2-doc RHEL 8 | 0:0.5.2-1.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-mysql2-doc ol 8 | 0:0.5.2-1.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-net-telnet RHEL 8 | 0:0.2.0-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-net-telnet ol 8 | 0:0.2.0-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-openssl RHEL 8 | 0:2.1.2-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-openssl ol 8 | 0:2.1.2-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-pg RHEL 8 | 0:1.1.4-1.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-pg ol 8 | 0:1.1.4-1.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-pg-doc RHEL 8 | 0:1.1.4-1.module+el8.1.0+3653+beb38eb0 | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-pg-doc ol 8 | 0:1.1.4-1.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-power_assert RHEL 8 | 0:1.1.3-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-power_assert ol 8 | 0:1.1.3-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-psych RHEL 8 | 0:3.1.0-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-psych ol 8 | 0:3.1.0-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-rake RHEL 8 | 0:12.3.3-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-rake ol 8 | 0:12.3.3-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-rdoc RHEL 8 | 0:6.1.2-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-rdoc ol 8 | 0:6.1.2-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-test-unit RHEL 8 | 0:3.2.9-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-test-unit ol 8 | 0:3.2.9-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygem-xmlrpc RHEL 8 | 0:0.3.0-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygem-xmlrpc ol 8 | 0:0.3.0-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygems RHEL 8 | 0:3.0.3.1-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygems ol 8 | 0:3.0.3.1-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |
| Linux | rubygems-devel RHEL 8 | 0:3.0.3.1-107.module+el8.4.0+10830+bbd85cce | [RHSA-2021:2588](https://patchblox.com/security/data/fix/linux/rhsa-2021-2588.md) | Jun 29, 2021 |
| Linux | rubygems-devel ol 8 | 0:3.0.3.1-107.module+el8.4.0+20235+1e5b8be3 | [ELSA-2021-2588](https://patchblox.com/security/data/fix/linux/elsa-2021-2588.md) | Jul 7, 2021 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.