Tsubasa Irisawa

**Name of the Vulnerable Software and Affected Versions** URI gem versions prior to 0.11.3 URI gem versions 0.12.0 through 0.12.3 URI gem versions 0.13.0 through 0.13.1 URI gem versions 1.0.0 through 1.0.2 **Description** The URI handling methods (`URI.join`, `URI#merge`, `URI#+`) in the URI gem for Ruby have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. This could lead to an unintended userinfo leak when generating a URL to a malicious host from a URL containing secret userinfo using these methods. **Recommendations** For URI gem versions prior to 0.11.3, update to version 0.11.3 or later. For URI gem versions 0.12.0 through 0.12.3, update to version 0.12.4 or later. For URI gem versions 0.13.0 through 0.13.1, update to version 0.13.2 or later. For URI gem versions 1.0.0 through 1.0.2, update to version 1.0.3 or later. As a temporary workaround, consider avoiding the use of `URI#join`, `URI#merge`, and `URI#+` methods until a patch is available.