Skip to content
OpenAdvisories
Medium ELSA-2023-3821 3 CVEs

Moderate: ruby:2.7 security, bug fix, and enhancement update (Oracle Linux 8)

Published Jul 8, 2023 · Updated Jul 8, 2023

Ecosystem: Oracle Linux

Summary

ruby
[2.7.8-139]
- Upgrade to Ruby 2.7.8.
Resolves: rhbz#2149262
- Fix HTTP response splitting in CGI.
Resolves: CVE-2021-33621
- Fix ReDoS vulnerability in URI.
Resolves: CVE-2023-28755
- Fix ReDoS vulnerability in Time.
Resolves: CVE-2023-28756

rubygem-abrt
[0.4.0-1]
- Update to abrt 0.4.0.
Resolves: rhbz#1842476

rubygem-bson
[4.8.1-1]
- Update to bson 4.8.1 by merging Fedora master branch (commit: 0741dbc)
Resolves: rhbz#1817135

rubygem-mongo
[2.11.3-1]
- Update to mongo 2.11.3 by merging Fedora master branch (commit: c3f83c2)
Resolves: rhbz#1817135

rubygem-mysql2
[0.5.3-2]
- Update by merging Fedora rawhide branch (commit: 81e2cc9)
- Fix Mysql2::Result test for Ruby 3.1.
- Remove gem_make.out and mkmf.log files from the binary RPM package.
- Fix test assertion for mariadb-connector-c.
Related: rhbz#2063772

[0.5.3-1]
- New upstream release 0.5.3 by merging Fedora master branch (commit: 674d475)
Resolves: rhbz#1817135

[0.5.2-1]
- New upstream release 0.5.2 by merging Fedora master branch (commit: cc15309)
Resolves: rhbz#1672575

rubygem-pg
[1.2.3-1]
- Update to pg 1.2.3 by merging Fedora master branch (commit: 5db4d26)
Resolves: rhbz#1817135

Fixed packages 31

ReleasePackageFixed in
Oracle Linux · 8 ruby 0:2.7.8-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 ruby-default-gems 0:2.7.8-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 ruby-devel 0:2.7.8-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 ruby-doc 0:2.7.8-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 ruby-libs 0:2.7.8-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-abrt 0:0.4.0-1.module+el8.3.0+7760+537395ec
Oracle Linux · 8 rubygem-abrt-doc 0:0.4.0-1.module+el8.3.0+7760+537395ec
Oracle Linux · 8 rubygem-bigdecimal 0:2.0.0-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-bson 0:4.8.1-1.module+el8.4.0+20239+cbf59dc8
Oracle Linux · 8 rubygem-bson-doc 0:4.8.1-1.module+el8.4.0+20239+cbf59dc8
Oracle Linux · 8 rubygem-bundler 0:2.2.24-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-io-console 0:0.5.6-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-irb 0:1.2.6-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-json 0:2.3.0-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-minitest 0:5.13.0-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-mongo 0:2.11.3-1.module+el8.3.0+7760+537395ec
Oracle Linux · 8 rubygem-mongo-doc 0:2.11.3-1.module+el8.3.0+7760+537395ec
Oracle Linux · 8 rubygem-mysql2 0:0.5.3-1.module+el8.4.0+20239+cbf59dc8
Oracle Linux · 8 rubygem-mysql2-doc 0:0.5.3-1.module+el8.4.0+20239+cbf59dc8
Oracle Linux · 8 rubygem-net-telnet 0:0.2.0-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-openssl 0:2.1.4-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-pg 0:1.2.3-1.module+el8.4.0+20239+cbf59dc8
Oracle Linux · 8 rubygem-pg-doc 0:1.2.3-1.module+el8.4.0+20239+cbf59dc8
Oracle Linux · 8 rubygem-power_assert 0:1.1.7-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-psych 0:3.1.0-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-rake 0:13.0.1-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-rdoc 0:6.2.1.1-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-test-unit 0:3.3.4-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygem-xmlrpc 0:0.3.0-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygems 0:3.1.6-139.module+el8.8.0+21111+2e34bf27
Oracle Linux · 8 rubygems-devel 0:3.1.6-139.module+el8.8.0+21111+2e34bf27

Vulnerabilities 3

  • High 8.8
    CVE-2021-33621

    HTTP response splitting in CGI

    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2023-28756

    Ruby Time component ReDoS issue

    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are …

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems
  • Medium 5.3
    CVE-2023-28755

    Ruby URI component ReDoS issue

    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems