Skip to content
OpenAdvisories
Medium ALAS2-2021-1641 3 CVEs

Moderate: ruby security update (Amazon Linux 2)

Published May 20, 2021 · Updated Feb 17, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31799: An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious Ruby source code could lead to execution of arbitrary commands with the privileges of the user running rdoc. CVE-2020-25613: An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack. CVE-2020-10663: A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem (including the one bundled with Ruby) can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269.

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 ruby 0:2.0.0.648-36.amzn2.0.2
Amazon Linux · 2 ruby-debuginfo 0:2.0.0.648-36.amzn2.0.2
Amazon Linux · 2 ruby-devel 0:2.0.0.648-36.amzn2.0.2
Amazon Linux · 2 ruby-doc 0:2.0.0.648-36.amzn2.0.2
Amazon Linux · 2 ruby-irb 0:2.0.0.648-36.amzn2.0.2
Amazon Linux · 2 ruby-libs 0:2.0.0.648-36.amzn2.0.2
Amazon Linux · 2 ruby-tcltk 0:2.0.0.648-36.amzn2.0.2
Amazon Linux · 2 rubygem-bigdecimal 0:1.2.0-36.amzn2.0.2
Amazon Linux · 2 rubygem-io-console 0:0.4.2-36.amzn2.0.2
Amazon Linux · 2 rubygem-json 0:1.7.7-36.amzn2.0.2
Amazon Linux · 2 rubygem-minitest 0:4.3.2-36.amzn2.0.2
Amazon Linux · 2 rubygem-psych 0:2.0.0-36.amzn2.0.2
Amazon Linux · 2 rubygem-rake 0:0.9.6-36.amzn2.0.2
Amazon Linux · 2 rubygem-rdoc 0:4.0.0-36.amzn2.0.2
Amazon Linux · 2 rubygems 0:2.0.14.1-36.amzn2.0.2
Amazon Linux · 2 rubygems-devel 0:2.0.14.1-36.amzn2.0.2

Vulnerabilities 3

  • High 7.5
    CVE-2020-10663 Public exploit

    Unsafe object creation in json RubyGem

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

    ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2020-25613 Public exploit

    WEBRick vulnerable to HTTP Request/Response Smuggling

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  • High 7.0
    CVE-2021-31799

    Arbitrary Code Execution in Rdoc

    In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-10663.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-25613.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-31799.html