Skip to content
OpenAdvisories
Medium ALSA-2021:2588 9 CVEs

Moderate: ruby:2.6 security, bug fix, and enhancement update

Published Jun 29, 2021 · Updated Nov 2, 2026

Ecosystem: AlmaLinux

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)

Security Fix(es):

* rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)

* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [almalinux-8] (BZ#1954968)

Fixed packages 20

ReleasePackageFixed in
AlmaLinux · 8 rubygem-abrt 0.3.0-4.module_el8.5.0+259+8cec6917
AlmaLinux · 8 rubygem-abrt 0.3.0-4.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-abrt-doc 0.3.0-4.module_el8.5.0+259+8cec6917
AlmaLinux · 8 rubygem-abrt-doc 0.3.0-4.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-bson 4.5.0-1.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-bson 4.5.0-1.module_el8.5.0+250+ba22dbf7
AlmaLinux · 8 rubygem-bson-doc 4.5.0-1.module_el8.5.0+250+ba22dbf7
AlmaLinux · 8 rubygem-bson-doc 4.5.0-1.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-mongo 2.8.0-1.module_el8.5.0+250+ba22dbf7
AlmaLinux · 8 rubygem-mongo 2.8.0-1.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-mongo-doc 2.8.0-1.module_el8.5.0+250+ba22dbf7
AlmaLinux · 8 rubygem-mongo-doc 2.8.0-1.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-mysql2 0.5.2-1.module_el8.5.0+250+ba22dbf7
AlmaLinux · 8 rubygem-mysql2 0.5.2-1.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-mysql2-doc 0.5.2-1.module_el8.5.0+250+ba22dbf7
AlmaLinux · 8 rubygem-mysql2-doc 0.5.2-1.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-pg 1.1.4-1.module_el8.5.0+250+ba22dbf7
AlmaLinux · 8 rubygem-pg 1.1.4-1.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-pg-doc 1.1.4-1.module_el8.5.0+2623+08a8ba32
AlmaLinux · 8 rubygem-pg-doc 1.1.4-1.module_el8.5.0+250+ba22dbf7

Vulnerabilities 9

  • High 7.5
    CVE-2020-10663 Public exploit

    Unsafe object creation in json RubyGem

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

    ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2020-25613 Public exploit

    WEBRick vulnerable to HTTP Request/Response Smuggling

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2021-28965

    REXML round-trip instability

    The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  • High 7.0
    CVE-2019-3881

    Insecure path handling in Bundler

    Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable…

    bundler bundler Ubuntu RubyGems
  • Unscored —
    CVE-2019-15845

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

    ruby2.3 ruby ruby2.5 Ubuntu Alpine
  • Unscored —
    CVE-2019-16201

    WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-16254

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-16255

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-10933

    An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

    ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/1651826
  • report
    https://bugzilla.redhat.com/1773728
  • report
    https://bugzilla.redhat.com/1789407
  • report
    https://bugzilla.redhat.com/1789556
  • report
    https://bugzilla.redhat.com/1793683
  • report
    https://bugzilla.redhat.com/1827500
  • report
    https://bugzilla.redhat.com/1833291
  • report
    https://bugzilla.redhat.com/1883623
  • report
    https://bugzilla.redhat.com/1947526
  • report
    https://bugzilla.redhat.com/1952627
  • report
    https://bugzilla.redhat.com/1954968
  • advisory
    https://errata.almalinux.org/8/ALSA-2021-2588.html
  • report
    https://vulners.com/cve/CVE-2019-15845
  • report
    https://vulners.com/cve/CVE-2019-16201
  • report
    https://vulners.com/cve/CVE-2019-16254
  • report
    https://vulners.com/cve/CVE-2019-16255
  • report
    https://vulners.com/cve/CVE-2019-3881
  • report
    https://vulners.com/cve/CVE-2020-10663
  • report
    https://vulners.com/cve/CVE-2020-10933
  • report
    https://vulners.com/cve/CVE-2020-25613
  • report
    https://vulners.com/cve/CVE-2021-28965