Moderate: ruby:3.0 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 28

Vulnerabilities 4

• High 7.5
  CVE-2021-41817

  Regular expression denial of service vulnerability (ReDoS) in date

  Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Jan 1, 2022
• High 7.5
  CVE-2021-41819

  Cookie Prefix Spoofing in CGI::Cookie.parse

  CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Jan 1, 2022
• Unscored —
  CVE-2022-28738

  A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to…

  ruby ruby3.0 Ubuntu Alpine
  May 9, 2022
• Unscored —
  CVE-2022-28739

  There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occ…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine
  May 9, 2022