Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-27282: ruby: Arbitrary memory address read vulnerability with Regex search CVE-2021-28965: A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using REXML and writing parsed data back to a new XML document results in creating a document with a different structure. This issue could affect the integrity of processed data in applications using REXML that parse XML documents, write data back to XML, and re-parse them again.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ruby | 0:2.0.0.648-36.amzn2.0.12 |
| Amazon Linux · 2 | ruby-debuginfo | 0:2.0.0.648-36.amzn2.0.12 |
| Amazon Linux · 2 | ruby-devel | 0:2.0.0.648-36.amzn2.0.12 |
| Amazon Linux · 2 | ruby-doc | 0:2.0.0.648-36.amzn2.0.12 |
| Amazon Linux · 2 | ruby-irb | 0:2.0.0.648-36.amzn2.0.12 |
| Amazon Linux · 2 | ruby-libs | 0:2.0.0.648-36.amzn2.0.12 |
| Amazon Linux · 2 | ruby-tcltk | 0:2.0.0.648-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygem-bigdecimal | 0:1.2.0-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygem-io-console | 0:0.4.2-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygem-json | 0:1.7.7-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygem-minitest | 0:4.3.2-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygem-psych | 0:2.0.0-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygem-rake | 0:0.9.6-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygem-rdoc | 0:4.0.0-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygems | 0:2.0.14.1-36.amzn2.0.12 |
| Amazon Linux · 2 | rubygems-devel | 0:2.0.14.1-36.amzn2.0.12 |
Vulnerabilities 2
-
High 7.5
REXML round-trip instability
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
-
Medium 6.6
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it…