Summary
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626)
Security Fix(es):
* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)
* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)
* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)
* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)
* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)
* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)
* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)
* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+2623+08a8ba32 |
| AlmaLinux · 8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+2623+08a8ba32 |
| AlmaLinux · 8 | rubygem-abrt-doc | 0.3.0-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-bson | 4.3.0-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-bson | 4.3.0-2.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-bson-doc | 4.3.0-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-bson-doc | 4.3.0-2.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-mongo | 2.5.1-2.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-mongo | 2.5.1-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-pg | 1.0.0-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-pg | 1.0.0-2.module_el8.5.0+259+8cec6917 |
| AlmaLinux · 8 | rubygem-pg-doc | 1.0.0-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux · 8 | rubygem-pg-doc | 1.0.0-2.module_el8.5.0+259+8cec6917 |
Vulnerabilities 8
-
High 7.5CVE-2020-10663 Public exploit
Unsafe object creation in json RubyGem
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…
-
High 7.5CVE-2020-25613 Public exploit
WEBRick vulnerable to HTTP Request/Response Smuggling
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…
-
High 7.5
REXML round-trip instability
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
-
Unscored —
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
-
Unscored —
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…
-
Unscored —
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…
-
Unscored —
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…
-
Unscored —
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…
References
-
report
https://bugzilla.redhat.com/1773728
-
report
https://bugzilla.redhat.com/1789407
-
report
https://bugzilla.redhat.com/1789556
-
report
https://bugzilla.redhat.com/1793683
-
report
https://bugzilla.redhat.com/1827500
-
report
https://bugzilla.redhat.com/1833291
-
report
https://bugzilla.redhat.com/1883623
-
report
https://bugzilla.redhat.com/1947526
-
report
https://bugzilla.redhat.com/1952626
-
report
https://bugzilla.redhat.com/1955010
-
advisory
https://errata.almalinux.org/8/ALSA-2021-2587.html
-
report
https://vulners.com/cve/CVE-2019-15845
-
report
https://vulners.com/cve/CVE-2019-16201
-
report
https://vulners.com/cve/CVE-2019-16254
-
report
https://vulners.com/cve/CVE-2019-16255
-
report
https://vulners.com/cve/CVE-2020-10663
-
report
https://vulners.com/cve/CVE-2020-10933
-
report
https://vulners.com/cve/CVE-2020-25613
-
report
https://vulners.com/cve/CVE-2021-28965