Skip to content
OpenAdvisories
High ELSA-2018-0378 11 CVEs

Important: ruby security update (Oracle Linux 7)

Published Feb 28, 2018 · Updated Feb 28, 2018

Ecosystem: Oracle Linux

Summary

[2.0.0.648-33]
- Fix always passing WEBrick test.

[2.0.0.648-32]
- Add Psych.safe_load
* ruby-2.1.0-there-should-be-only-one-exception.patch
* ruby-2.1.0-Adding-Psych.safe_load.patch
Related: CVE-2017-0903
- Disable Tokyo TZ tests broken by recen tzdata update.
* ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
Related: CVE-2017-0903

[2.0.0.648-31]
- Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
* ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
-vulnerability.patch
Resolves: CVE-2017-0903
- Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
Resolves: CVE-2017-0899
- Fix a DOS vulernerability in the query command (CVE-2017-0900).
Resolves: CVE-2017-0900
- Fix a vulnerability in the gem installer that allowed a malicious gem
to overwrite arbitrary files (CVE-2017-0901).
Resolves: CVE-2017-0901
- Fix a DNS request hijacking vulnerability (CVE-2017-0902).
* ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
Resolves: CVE-2017-0902
- Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
* ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
Resolves: CVE-2017-0898
- Escape sequence injection vulnerability in the Basic
authentication of WEBrick (CVE-2017-10784).
* ruby-2.2.8-sanitize-any-type-of-logs.patch
Resolves: CVE-2017-10784
- Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
* ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
Resolves: CVE-2017-14064
- Command injection vulnerability in Net::FTP (CVE-2017-17405).
* ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
Resolves: CVE-2017-17405
- Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
* ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
Resolves: CVE-2017-14033
- Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
execution(CVE-2017-17790).
* ruby-2.5.0-Fixed-command-Injection.patch
Resolves: CVE-2017-17790

Fixed packages 15

ReleasePackageFixed in
Oracle Linux · 7 ruby 0:2.0.0.648-33.el7_4
Oracle Linux · 7 ruby-devel 0:2.0.0.648-33.el7_4
Oracle Linux · 7 ruby-doc 0:2.0.0.648-33.el7_4
Oracle Linux · 7 ruby-irb 0:2.0.0.648-33.el7_4
Oracle Linux · 7 ruby-libs 0:2.0.0.648-33.el7_4
Oracle Linux · 7 ruby-tcltk 0:2.0.0.648-33.el7_4
Oracle Linux · 7 rubygem-bigdecimal 0:1.2.0-33.el7_4
Oracle Linux · 7 rubygem-io-console 0:0.4.2-33.el7_4
Oracle Linux · 7 rubygem-json 0:1.7.7-33.el7_4
Oracle Linux · 7 rubygem-minitest 0:4.3.2-33.el7_4
Oracle Linux · 7 rubygem-psych 0:2.0.0-33.el7_4
Oracle Linux · 7 rubygem-rake 0:0.9.6-33.el7_4
Oracle Linux · 7 rubygem-rdoc 0:4.0.0-33.el7_4
Oracle Linux · 7 rubygems 0:2.0.14.1-33.el7_4
Oracle Linux · 7 rubygems-devel 0:2.0.14.1-33.el7_4

Vulnerabilities 11

  • Critical 9.8
    CVE-2017-0899 EPSS 11%

    RubyGems Code Injection vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • Critical 9.8
    CVE-2017-0903 EPSS 16%

    RubyGems vulnerable to Deserialization of Untrusted Data

    RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remo…

    HackerOne RubyGems ruby2.3 jruby Debian Ubuntu RubyGems
  • High 8.8
    CVE-2017-10784 EPSS 16%

    WEBrick RCE Vulnerability

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user nam…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine RubyGems
  • High 8.1
    CVE-2017-0902

    RubyGems has Origin Validation Error vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-0900

    RubyGems Improper Input Validation vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.

    ruby2.3 ruby jruby ruby1.9.1 Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-0901 Public exploit EPSS 29%

    RubyGems may allow a maliciously crafted gem to overwrite files

    RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-14033

    Ruby OpenSSL DoS Vulnerability

    The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.

    ruby2.3 ruby ruby1.9.1 ruby2.2 Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2017-0898

    Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) …

    HackerOne Ruby ruby2.3 ruby Ubuntu Alpine
  • Unscored —
    CVE-2017-14064

    Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate cal…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine
  • Unscored —
    CVE-2017-17405 Public exploit EPSS 74%

    Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and …

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine
  • Unscored —
    CVE-2017-17790

    The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injecti…

    ruby2.3 ruby1.9.1 Ubuntu