Skip to content
OpenAdvisories
Medium ALAS2-2024-2634 1 CVE

Moderate: ruby security update (Amazon Linux 2)

Published Sep 12, 2024 · Updated Sep 18, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-27281: ruby: RCE vulnerability with .rdoc_options in RDoc

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 ruby 0:2.0.0.648-36.amzn2.0.11
Amazon Linux · 2 ruby-debuginfo 0:2.0.0.648-36.amzn2.0.11
Amazon Linux · 2 ruby-devel 0:2.0.0.648-36.amzn2.0.11
Amazon Linux · 2 ruby-doc 0:2.0.0.648-36.amzn2.0.11
Amazon Linux · 2 ruby-irb 0:2.0.0.648-36.amzn2.0.11
Amazon Linux · 2 ruby-libs 0:2.0.0.648-36.amzn2.0.11
Amazon Linux · 2 ruby-tcltk 0:2.0.0.648-36.amzn2.0.11
Amazon Linux · 2 rubygem-bigdecimal 0:1.2.0-36.amzn2.0.11
Amazon Linux · 2 rubygem-io-console 0:0.4.2-36.amzn2.0.11
Amazon Linux · 2 rubygem-json 0:1.7.7-36.amzn2.0.11
Amazon Linux · 2 rubygem-minitest 0:4.3.2-36.amzn2.0.11
Amazon Linux · 2 rubygem-psych 0:2.0.0-36.amzn2.0.11
Amazon Linux · 2 rubygem-rake 0:0.9.6-36.amzn2.0.11
Amazon Linux · 2 rubygem-rdoc 0:4.0.0-36.amzn2.0.11
Amazon Linux · 2 rubygems 0:2.0.14.1-36.amzn2.0.11
Amazon Linux · 2 rubygems-devel 0:2.0.14.1-36.amzn2.0.11

Vulnerabilities 1

  • Medium 4.5
    CVE-2024-27281

    RDoc RCE vulnerability with .rdoc_options

    An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no r…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Azure Linux Alpine Wolfi RubyGems

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27281.html