What it is about

Ruby ist eine interpretierte, objektorientierte Skriptsprache. Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby und Ruby on Rails ausnutzen, um Sicherheitsmaßnahmen zu umgehen und so beliebigen Code auszuführen.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• Sicherheitsmaßnahmen zu umgehen
• so beliebigen Code auszuführen

Am I affected?

Affected according to the BSI:

• Debian Linux
• Red Hat Enterprise Linux
• Oracle Linux
• RESF Rocky Linux
• Gentoo Linux
• Open Source Ruby erb gem <4.0.3.1
• Open Source Ruby erb gem <4.0.4.1
• Open Source Ruby erb gem <6.0.1.1
• Open Source Ruby erb gem <6.0.4
• Open Source Ruby on Rails erb gem <4.0.3.1
• Open Source Ruby on Rails erb gem <4.0.4.1
• Open Source Ruby on Rails erb gem <6.0.1.1

and 10 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Open Source Ruby erb gem 4.0.3.1
• Open Source Ruby erb gem 4.0.4.1
• Open Source Ruby erb gem 6.0.1.1
• Open Source Ruby erb gem 6.0.4
• Open Source Ruby on Rails erb gem 4.0.3.1
• Open Source Ruby on Rails erb gem 4.0.4.1
• Open Source Ruby on Rails erb gem 6.0.1.1
• Open Source Ruby on Rails erb gem 6.0.4

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.