ELSA-2021-2587 — Moderate: ruby:2.5 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

ruby
[2.5.9-107]
- Update to Ruby 2.5.9.
* Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
Resolves: rhbz#1952626
- Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
contains leading zero
Resolves: rhbz#1955010

Fixed packages 32

Release	Package	Fixed in
Oracle Linux · 8	ruby	0:2.5.9-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	ruby-devel	0:2.5.9-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	ruby-doc	0:2.5.9-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	ruby-irb	0:2.5.9-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	ruby-libs	0:2.5.9-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-abrt	0:0.3.0-4.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-abrt-doc	0:0.3.0-4.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-bigdecimal	0:1.3.4-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-bson	0:4.3.0-2.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-bson-doc	0:4.3.0-2.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-bundler	0:1.16.1-3.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-bundler-doc	0:1.16.1-3.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-did_you_mean	0:1.2.0-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-io-console	0:0.4.6-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-json	0:2.1.0-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-minitest	0:5.10.3-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-mongo	0:2.5.1-2.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-mongo-doc	0:2.5.1-2.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-mysql2	0:0.4.10-4.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-mysql2-doc	0:0.4.10-4.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-net-telnet	0:0.1.1-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-openssl	0:2.1.2-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-pg	0:1.0.0-2.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-pg-doc	0:1.0.0-2.module+el8.3.0+7756+e45777e9
Oracle Linux · 8	rubygem-power_assert	0:1.1.1-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-psych	0:3.0.2-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-rake	0:12.3.3-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-rdoc	0:6.0.1.1-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-test-unit	0:3.2.7-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygem-xmlrpc	0:0.3.0-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygems	0:2.7.6.3-107.module+el8.4.0+20203+c00aa653
Oracle Linux · 8	rubygems-devel	0:2.7.6.3-107.module+el8.4.0+20203+c00aa653

Vulnerabilities 8

High 7.5

CVE-2020-10663 Public exploit

Unsafe object creation in json RubyGem

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems

Apr 28, 2020
High 7.5

CVE-2020-25613 Public exploit

WEBRick vulnerable to HTTP Request/Response Smuggling

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems

Oct 6, 2020
High 7.5

CVE-2021-28965

REXML round-trip instability

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems

Apr 21, 2021
Unscored —

CVE-2019-15845

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

ruby2.3 ruby ruby2.5 Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16201

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16254

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2020-10933

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine

May 4, 2020

Moderate: ruby:2.5 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 32

Vulnerabilities 8

Unsafe object creation in json RubyGem

WEBRick vulnerable to HTTP Request/Response Smuggling

REXML round-trip instability

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…