Summary
ruby
[2.5.9-109]
- Properly fix command injection vulnerability in Rdoc.
Related: CVE-2021-31799
[2.5.9-108]
- Fix command injection vulnerability in RDoc.
Resolves: CVE-2021-31799
- Fix StartTLS stripping vulnerability in Net::IMAP
Resolves: CVE-2021-32066
- Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
Resolves: CVE-2021-31810
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | rubygem-abrt | 0:0.3.0-4.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-abrt-doc | 0:0.3.0-4.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-bson | 0:4.3.0-2.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-bson-doc | 0:4.3.0-2.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-bundler | 0:1.16.1-4.module+el8.5.0+20497+d0a7b862 |
| Oracle Linux · 8 | rubygem-bundler-doc | 0:1.16.1-4.module+el8.5.0+20497+d0a7b862 |
| Oracle Linux · 8 | rubygem-mongo | 0:2.5.1-2.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-mongo-doc | 0:2.5.1-2.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-mysql2-doc | 0:0.4.10-4.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-pg | 0:1.0.0-2.module+el8.3.0+7756+e45777e9 |
| Oracle Linux · 8 | rubygem-pg-doc | 0:1.0.0-2.module+el8.3.0+7756+e45777e9 |
Vulnerabilities 3
-
High 7.0
Arbitrary Code Execution in Rdoc
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
-
Unscored —
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…
-
Unscored —
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …