CVE-2019-15845 — ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?

MEDIUM

ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?

Published Nov 26, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 3.32%

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

Red Hat Enterprise Linux 8

ruby:2.5-8040020200923213910.522a0ee4

Fixed · RHSA-2021:2587
Red Hat Enterprise Linux 8

ruby:2.6-8040020210430142949.522a0ee4

Fixed · RHSA-2021:2588
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

ruby:2.6-8010020220201152941.c27ad7f8

Fixed · RHSA-2022:0581
Red Hat Enterprise Linux 8.2 Extended Update Support

ruby:2.6-8020020220201131207.4cda2c84

Fixed · RHSA-2022:0582
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-ruby25-ruby-0:2.5.9-9.el7

Fixed · RHSA-2021:2104
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-ruby26-ruby-0:2.6.7-119.el7

Fixed · RHSA-2021:2230
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-ruby25-ruby-0:2.5.9-9.el7

Fixed · RHSA-2021:2104
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-ruby25-ruby-0:2.5.9-9.el7

Fixed · RHSA-2021:2104
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-ruby26-ruby-0:2.6.7-119.el7

Fixed · RHSA-2021:2230
Red Hat 3scale API Management Platform 2

3amp-system

Will not fix
Red Hat Enterprise Linux 5

ruby

Out of support scope
Red Hat Enterprise Linux 6

ruby

Out of support scope
Red Hat Enterprise Linux 7

ruby

Will not fix
Red Hat Software Collections

rh-ruby24-ruby

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	ruby:2.5-8040020200923213910.522a0ee4	Fixed	RHSA-2021:2587
Red Hat Enterprise Linux 8	ruby:2.6-8040020210430142949.522a0ee4	Fixed	RHSA-2021:2588
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	ruby:2.6-8010020220201152941.c27ad7f8	Fixed	RHSA-2022:0581
Red Hat Enterprise Linux 8.2 Extended Update Support	ruby:2.6-8020020220201131207.4cda2c84	Fixed	RHSA-2022:0582
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-ruby25-ruby-0:2.5.9-9.el7	Fixed	RHSA-2021:2104
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-ruby26-ruby-0:2.6.7-119.el7	Fixed	RHSA-2021:2230
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-ruby25-ruby-0:2.5.9-9.el7	Fixed	RHSA-2021:2104
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-ruby25-ruby-0:2.5.9-9.el7	Fixed	RHSA-2021:2104
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-ruby26-ruby-0:2.6.7-119.el7	Fixed	RHSA-2021:2230
Red Hat 3scale API Management Platform 2	3amp-system	Will not fix	n/a
Red Hat Enterprise Linux 5	ruby	Out of support scope	n/a
Red Hat Enterprise Linux 6	ruby	Out of support scope	n/a
Red Hat Enterprise Linux 7	ruby	Will not fix	n/a
Red Hat Software Collections	rh-ruby24-ruby	Will not fix	n/a

Red Hat mitigation

It is possible to test for presence of the NULL byte manually prior to call the affected methods with an untrusted string.

3.32% 0.03317

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.03317

2021–2026

Table of values (18 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	3.32% (0.03317)	88.19th	v5 (v2026.06.15)
Jun 15, 2026	3.23% (0.03227)	86.58th	v5 (v2026.06.15)
Mar 17, 2025	0.32% (0.00320)	52.83th	v4 (v2025.03.14)
Dec 12, 2024	0.69% (0.00688)	80.78th	v3 (v2023.03.01)
Mar 21, 2024	0.43% (0.00425)	73.84th	v3 (v2023.03.01)
Feb 8, 2024	0.30% (0.00303)	68.85th	v3 (v2023.03.01)
Nov 2, 2023	0.30% (0.00303)	66.33th	v3 (v2023.03.01)
Oct 17, 2023	0.27% (0.00265)	63.84th	v3 (v2023.03.01)
Sep 30, 2023	0.28% (0.00277)	64.46th	v3 (v2023.03.01)
Mar 7, 2023	0.29% (0.00285)	63.74th	v3 (v2023.03.01)
Mar 6, 2023	1.54% (0.01537)	74.52th	v2 (v2022.01.01)
Feb 23, 2023	1.54% (0.01537)	74.48th	v2 (v2022.01.01)
Apr 1, 2022	1.54% (0.01537)	72.41th	v2 (v2022.01.01)
Feb 4, 2022	16.31% (0.16306)	92.84th	v2 (v2022.01.01)
Feb 3, 2022	8.66% (0.08659)	85.81th	v1
Jan 6, 2022	8.66% (0.08659)	85.64th	v1
Sep 1, 2021	2.07% (0.02069)	77.27th	v1
Apr 14, 2021	2.07% (0.02069)	0.00th	v1

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html		vendor-advisoryx_refsource_SUSE
https://access.redhat.com/security/cve/CVE-2019-15845		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1789407		Issue Tracking
https://hackerone.com/reports/449617		x_refsource_MISCThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15845
https://seclists.org/bugtraq/2019/Dec/31		mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
https://seclists.org/bugtraq/2019/Dec/32		mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
https://security.gentoo.org/glsa/202003-06		vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/4201-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-15845
https://www.debian.org/security/2019/dsa-4587		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html		x_refsource_MISCThird Party Advisory
https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/