jruby - security update

Fixed packages 1

Vulnerabilities 9

• High 7.5
  CVE-2020-25613 Public exploit

  WEBRick vulnerable to HTTP Request/Response Smuggling

  An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  Oct 6, 2020
• High 7.5
  CVE-2023-28756

  Ruby Time component ReDoS issue

  A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are …

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems
  Mar 31, 2023
• Medium 5.3
  CVE-2023-28755

  Ruby URI component ReDoS issue

  A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems
  Mar 31, 2023
• Unscored —
  CVE-2017-17742

  Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Respo…

  ruby2.3 ruby jruby ruby2.0 Debian Ubuntu Alpine
  Apr 3, 2018
• Unscored —
  CVE-2019-16201

  WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2019-16254

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2019-16255

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2021-31810

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine
  Jul 13, 2021
• Unscored —
  CVE-2021-32066

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine
  Aug 1, 2021