Skip to content
OpenAdvisories
High ALAS2023-2023-158 2 CVEs

Important: ruby3.2 security update (Amazon Linux 2023)

Published Apr 13, 2023 · Updated Apr 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28756: A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. CVE-2023-28755: A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

Fixed packages 32

ReleasePackageFixed in
Amazon Linux · 2023 ruby3.2 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-bundled-gems 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-bundled-gems-debuginfo 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-debuginfo 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-debugsource 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-default-gems 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-devel 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-doc 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-libs 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-libs-debuginfo 0:3.2.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-bigdecimal 0:3.1.3-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-bigdecimal-debuginfo 0:3.1.3-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-bundler 0:2.4.10-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-io-console 0:0.6.0-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-io-console-debuginfo 0:0.6.0-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-irb 0:1.6.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-json 0:2.6.3-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-json-debuginfo 0:2.6.3-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-minitest 0:5.16.3-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-power_assert 0:2.0.3-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-psych 0:5.0.1-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-psych-debuginfo 0:5.0.1-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-rake 0:13.0.6-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-rbs 0:2.8.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-rbs-debuginfo 0:2.8.2-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-rdoc 0:6.5.0-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-rexml 0:3.2.5-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-rss 0:0.2.9-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-test-unit 0:3.5.7-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygem-typeprof 0:0.21.3-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygems 0:3.4.10-180.amzn2023.0.1
Amazon Linux · 2023 ruby3.2-rubygems-devel 0:3.4.10-180.amzn2023.0.1

Vulnerabilities 2

  • High 7.5
    CVE-2023-28756

    Ruby Time component ReDoS issue

    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are …

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems
  • Medium 5.3
    CVE-2023-28755

    Ruby URI component ReDoS issue

    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-28755.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-28756.html