Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2008-3657

34
FAUCET Score

CVE-2008-3657 is a vulnerability in the dl module of Ruby versions 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423. It allows attackers to bypass Ruby's safe levels and execute dangerous functions by accessing libraries via DL.dlopen without proper input "taintness" checks. This vulnerability has a CVSS score of 7.5, indicating high severity with network-based attacks and low complexity, potentially leading to partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, there is a public exploit available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 1.8.5CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
1.6.8CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:1.6.8:*:*:*:*:*:*:*
1.8.0CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:1.8.0:*:*:*:*:*:*:*
1.8.1CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:1.8.1:*:*:*:*:*:*:*
1.8.1CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:1.8.1:-9:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

7.5HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Exploitability Score
10.0
Impact Score
6.4
CvssVersion
2.0

Exploit Intelligence

EPSS Score
13.67%
Probability of exploitation in next 30 days
EPSS Percentile
96.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
ExploitDB: EDB-32223 · Aug 11, 2008
This CVE's current EPSS score of 0.1367 is in the 94th percentile among its peer group of 51,553 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: ruby-0:1.8.1-7.el4_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: ruby-0:1.8.5-5.el5_2.5
View patch

Vendor Advisories (1)

redhatCVE-2008-3657Low

ruby: missing "taintness" checks in dl module

Aug 8, 2008

References

bugs.debian.org / cgi-bin/bugreport.cgi
lists.apple.com / archives/security-announce/2009/May/msg00002.html
secunia.com / advisories/31430
Vendor Advisory
secunia.com / advisories/31697
Vendor Advisory
secunia.com / advisories/32165
Vendor Advisory
secunia.com / advisories/32219
Vendor Advisory
secunia.com / advisories/32255
Vendor Advisory
secunia.com / advisories/32256
Vendor Advisory
secunia.com / advisories/32371
Vendor Advisory
secunia.com / advisories/33178
Vendor Advisory
secunia.com / advisories/35074
Vendor Advisory
security.gentoo.org / glsa/glsa-200812-17.xml
exchange.xforce.ibmcloud.com / vulnerabilities/44372
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9793
support.apple.com / kb/HT3549
support.avaya.com / elmodocs2/security/ASA-2008-424.htm
usn.ubuntu.com / 651-1
redhat.com / archives/fedora-package-announce/2008-October/msg00259.html
redhat.com / archives/fedora-package-announce/2008-October/msg00299.html
wiki.rpath.com / wiki/Advisories:rPSA-2008-0264
debian.org / security/2008/dsa-1651
debian.org / security/2008/dsa-1652
redhat.com / support/errata/RHSA-2008-0897.html
ruby-lang.org / en/news/2008/08/08/multiple-vulnerabilities-in-ruby
securityfocus.com / archive/1/495884/100/0/threaded
securityfocus.com / bid/30644
ExploitPatch
securitytracker.com / id
us-cert.gov / cas/techalerts/TA09-133A.html
US Government Resource
vupen.com / english/advisories/2008/2334
Vendor Advisory
vupen.com / english/advisories/2009/1297
Vendor Advisory