Skip to content
OpenAdvisories
Medium ELSA-2021-2588 9 CVEs

Moderate: ruby:2.6 security, bug fix, and enhancement update (Oracle Linux 8)

Published Jul 7, 2021 · Updated Jul 7, 2021

Ecosystem: Oracle Linux

Summary

ruby
[2.6.7-107]
- Upgrade to Ruby 2.6.7.
Resolves: rhbz#1952627
- Resolv::DNS: timeouts if multiple IPv6 name servers are given an address
containing leading zero
Resolves: rhbz#1954968
- Fix: Rubygem-bundler: Don't use insecure tmp directory as home
allows for execution of malicious code.
Resolves: rhbz#1954969

Fixed packages 31

ReleasePackageFixed in
Oracle Linux · 8 ruby 0:2.6.7-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 ruby-devel 0:2.6.7-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 ruby-doc 0:2.6.7-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 ruby-libs 0:2.6.7-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-abrt 0:0.3.0-4.module+el8.1.0+5406+ce01f9b9
Oracle Linux · 8 rubygem-abrt-doc 0:0.3.0-4.module+el8.1.0+5406+ce01f9b9
Oracle Linux · 8 rubygem-bigdecimal 0:1.4.1-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-bson 0:4.5.0-1.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-bson-doc 0:4.5.0-1.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-bundler 0:1.17.2-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-did_you_mean 0:1.3.0-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-io-console 0:0.4.7-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-irb 0:1.0.0-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-json 0:2.1.0-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-minitest 0:5.11.3-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-mongo 0:2.8.0-1.module+el8.1.0+5406+ce01f9b9
Oracle Linux · 8 rubygem-mongo-doc 0:2.8.0-1.module+el8.1.0+5406+ce01f9b9
Oracle Linux · 8 rubygem-mysql2 0:0.5.2-1.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-mysql2-doc 0:0.5.2-1.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-net-telnet 0:0.2.0-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-openssl 0:2.1.2-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-pg 0:1.1.4-1.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-pg-doc 0:1.1.4-1.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-power_assert 0:1.1.3-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-psych 0:3.1.0-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-rake 0:12.3.3-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-rdoc 0:6.1.2-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-test-unit 0:3.2.9-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygem-xmlrpc 0:0.3.0-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygems 0:3.0.3.1-107.module+el8.4.0+20235+1e5b8be3
Oracle Linux · 8 rubygems-devel 0:3.0.3.1-107.module+el8.4.0+20235+1e5b8be3

Vulnerabilities 9

  • High 7.5
    CVE-2020-10663 Public exploit

    Unsafe object creation in json RubyGem

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

    ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2020-25613 Public exploit

    WEBRick vulnerable to HTTP Request/Response Smuggling

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2021-28965

    REXML round-trip instability

    The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  • High 7.0
    CVE-2019-3881

    Insecure path handling in Bundler

    Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable…

    bundler bundler Ubuntu RubyGems
  • Unscored —
    CVE-2019-15845

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

    ruby2.3 ruby ruby2.5 Ubuntu Alpine
  • Unscored —
    CVE-2019-16201

    WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-16254

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-16255

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-10933

    An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

    ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine