CVE-2018-16396
ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 17, 2018
Updated · June 28, 2026
Description
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
Statement
Subscription Asset Manager is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates.
Red Hat Virtualization includes a vulnerable version of ruby, however the affected functionality is not used in Red Hat Virtualization or any of its dependencies. A future update may address this issue.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-20 · Improper Input Validation