ruby2.5 - security update

Fixed packages 1

Vulnerabilities 6

• High 7.5
  CVE-2021-28965

  REXML round-trip instability

  The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Apr 21, 2021
• High 7.5
  CVE-2021-41817

  Regular expression denial of service vulnerability (ReDoS) in date

  Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Jan 1, 2022
• High 7.5
  CVE-2021-41819

  Cookie Prefix Spoofing in CGI::Cookie.parse

  CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Jan 1, 2022
• High 7.0
  CVE-2021-31799

  Arbitrary Code Execution in Rdoc

  In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  Jul 29, 2021
• Unscored —
  CVE-2021-31810

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine
  Jul 13, 2021
• Unscored —
  CVE-2021-32066

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine
  Aug 1, 2021