Summary
[2.0.0.648-34]
- CVE-2018-16395: Fix OpenSSL::X509::Name equality check does not work.
Resolves: CVE-2018-16395
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ruby | 0:2.0.0.648-34.el7_6 |
| Oracle Linux · 7 | ruby-devel | 0:2.0.0.648-34.el7_6 |
| Oracle Linux · 7 | ruby-doc | 0:2.0.0.648-34.el7_6 |
| Oracle Linux · 7 | ruby-irb | 0:2.0.0.648-34.el7_6 |
| Oracle Linux · 7 | ruby-libs | 0:2.0.0.648-34.el7_6 |
| Oracle Linux · 7 | ruby-tcltk | 0:2.0.0.648-34.el7_6 |
| Oracle Linux · 7 | rubygem-bigdecimal | 0:1.2.0-34.el7_6 |
| Oracle Linux · 7 | rubygem-io-console | 0:0.4.2-34.el7_6 |
| Oracle Linux · 7 | rubygem-json | 0:1.7.7-34.el7_6 |
| Oracle Linux · 7 | rubygem-minitest | 0:4.3.2-34.el7_6 |
| Oracle Linux · 7 | rubygem-psych | 0:2.0.0-34.el7_6 |
| Oracle Linux · 7 | rubygem-rake | 0:0.9.6-34.el7_6 |
| Oracle Linux · 7 | rubygem-rdoc | 0:4.0.0-34.el7_6 |
| Oracle Linux · 7 | rubygems | 0:2.0.14.1-34.el7_6 |
| Oracle Linux · 7 | rubygems-devel | 0:2.0.14.1-34.el7_6 |
Vulnerabilities 1
-
Critical 9.8CVE-2018-16395 EPSS 11%
Ruby Openssl Allows Incorrect Value Comparison
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return t…