Skip to content
OpenAdvisories
Medium ELSA-2023-7025 4 CVEs

Moderate: ruby:2.5 security update (Oracle Linux 8)

Published Nov 18, 2023 · Updated Nov 18, 2023

Summary

rubygem-abrt
[0.3.0-4]
- Execute test suite unconditionally.
- Upload correct sources.

[0.3.0-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[0.3.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[0.3.0-1]
- Update to abrt 0.3.0.

[0.2.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[0.2.0-1]
- Update to abrt 0.2.0.

[0.1.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[0.1.1-1]
- Update to abrt 0.1.1.

[0.0.6-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[0.0.6-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[0.0.6-1]
- Update to abrt 0.0.6.

[0.0.5-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

[0.0.5-2]
- Disable tests for EL builds.

[0.0.5-1]
- Update to abrt 0.0.5.

[0.0.3-3]
- Rebuild for https://fedoraproject.org/wiki/Features/Ruby_2.0.0

[0.0.3-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

[0.0.3-1]
- Update to abrt 0.0.3.

[0.0.2-1]
- Initial package

rubygem-bson
rubygem-bundler
rubygem-mongo
[2.5.1-2]
- Disable tests to fix FTBFS by dropped MongoDB module.
Resolves: rhbz#1710863

[2.5.1-1]
- Update to mongo 2.5.1.

[2.5.0-1]
- Update to mongo 2.5.0.

[2.4.3-2]
- Escape macros in %changelog

[2.4.3-1]
- Update to mongo 2.4.3.

[2.4.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.4.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[2.4.1-1]
- Update to mongo 2.4.1.

[2.4.0-1]
- Update to mongo 2.4.0.

[2.3.0-1]
- Update to mongo 2.3.0.

[1.10.2-5]
- Disable tests until mongodb becomes stable in rawhide again.

[1.10.2-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[1.10.2-2]
- Fix tests

[1.10.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[1.10.2-1]
- Update to mongo 1.10.2.

[1.9.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[1.9.2-1]
- Update to mongo 1.9.2.
- Enabled test suite.

[1.6.4-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

[1.6.4-4]
- Fix to make it build/install on F19+

[1.6.4-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

[1.6.4-2]
- Fixed doc
- removed more BuildRequires that are not required

[1.6.4-1]
- Updated to latest version
- Removed BuildRequires that are not needed

[1.4.0-7]
- Fixed checks.
Only run checks that do not require a running mongodb server

[1.4.0-6]
- Changed .gemspec and Rakefile to not be doc
- Added checks

[1.4.0-5]
- Fixed rubygem(bson) requires

[1.4.0-4]
- Updated to meet new fedora rubygem guidelines

[1.4.0-3]
- Changed group to Development/Languages
- Changed the global variables
- Seperated the doc and test into the doc rpm

[1.4.0-2]
- Added %{?dist} to version

[1.4.0-1]
- Initial package

rubygem-mysql2
rubygem-pg
[1.0.0-3]
- Fix FTBFS with PostgreSQL 10.6 and above.

ruby
[2.5.9-111]
- Fix HTTP response splitting in CGI.
Resolves: CVE-2021-33621
- Fix Buffer overrun in String-to-Float conversion.
Resolves: CVE-2022-28739
- Fix ReDoS vulnerability in URI.
Resolves: CVE-2023-28755
- Fix ReDoS vulnerability in Time.
Resolves: CVE-2023-28756

[2.5.9-111]
- Fix rdoc parsing of nil text tokens.
Resolves: rhbz#2210326

[2.5.9-110]
- Fix FTBFS due to an incompatible load directive.
- Fix a fiddle import test on an optimized glibc on Power 9.
- Fix by adding length limit option for methods that parses date strings.
Resolves: CVE-2021-41817
- CGI::Cookie.parse no longer decodes cookie names to prevent spoofing security
prefixes in cookie names.
Resolves: CVE-2021-41819

[2.5.9-109]
- Properly fix command injection vulnerability in Rdoc.
Related: CVE-2021-31799

[2.5.9-108]
- Fix command injection vulnerability in RDoc.
Resolves: CVE-2021-31799
- Fix StartTLS stripping vulnerability in Net::IMAP
Resolves: CVE-2021-32066
- Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
Resolves: CVE-2021-31810

[2.5.9-107]
- Update to Ruby 2.5.9.
* Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
Resolves: rhbz#1757844
- Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
contains leading zero
Resolves: rhbz#1950308

[2.5.5-106]
- Remove file with non-commercial license from did_you_mean gem.
Resolves: rhbz#1846113

[2.5.5-105]
- Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
Resolves: rhbz#1727832
- Properly support %prerelease in %gemspec_ macros.
Related: rhbz#1688758
- Fix rdoc gzipped javascript pages are not the same across multilib.
Resolves: rhbz#1719647

[2.5.5-104]
- Update to Ruby 2.5.5.
* Remove Patch25: ruby-2.6.0-Update-for-tzdata-2018f.patch; subsumed
* Remove Patch11: ruby-2.6.0-Try-to-update-cert.patch; subsumed
* Remove Patch19: ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with
-TLS-1.3.patch; subsumed
Resolves: rhbz#1688758
- Don't ship .stp files when SystemTap support is disabled.
Related: rhbz#1657915
- Fix CovScan issues.
Resolves: rhbz#1628592

[2.5.3-103]
- Refresh expired certificates to fix FTBFS.

[2.5.3-102]
- Fix Tokyo TZ tests.

[2.5.3-101]
- Update to Ruby 2.5.3.
Resolves: rhbz#1643092

[2.5.1-100]
- Properly harden package using -fstack-protector-strong.
* ruby-2.6.0-configure-fstack-protector-strong.patch
Resolves: rhbz#1624168

[2.5.1-99]
- Additional OpenSSL 1.1.1 fixes.
* ruby-2.6.0-fix-test-failure-with-TLS-1.3-maint.patch
* ruby-2.6.0-config-support-include-directive.patch
* ruby-2.6.0-use-larger-keys-for-SSL-tests.patch
Related: rhbz#1616213

[2.5.1-99]
- Fix generated rdoc template issues.
* ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch
Resolves: rhbz#1612026

[2.5.1-97]
- Fix TLS 1.3 issues.
* ruby-2.6.0-fix-test-failure-with-TLS-1.3.patch
* ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with-TLS-1.3.patch
Related: rhbz#1616213

[2.5.1-96]
- turn off tests
- Related: bug#1614611

[

Fixed packages 32

ReleasePackageFixed in
Oracle Linux · 8 ruby 0:2.5.9-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 ruby-devel 0:2.5.9-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 ruby-doc 0:2.5.9-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 ruby-irb 0:2.5.9-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 ruby-libs 0:2.5.9-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-abrt 0:0.3.0-4.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-abrt-doc 0:0.3.0-4.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-bigdecimal 0:1.3.4-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-bson 0:4.3.0-2.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-bson-doc 0:4.3.0-2.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-bundler 0:1.16.1-4.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-bundler-doc 0:1.16.1-4.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-did_you_mean 0:1.2.0-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-io-console 0:0.4.6-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-json 0:2.1.0-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-minitest 0:5.10.3-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-mongo 0:2.5.1-2.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-mongo-doc 0:2.5.1-2.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-mysql2 0:0.4.10-4.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-mysql2-doc 0:0.4.10-4.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-net-telnet 0:0.1.1-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-openssl 0:2.1.2-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-pg 0:1.0.0-3.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-pg-doc 0:1.0.0-3.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-power_assert 0:1.1.1-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-psych 0:3.0.2-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-rake 0:12.3.3-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-rdoc 0:6.0.1.1-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-test-unit 0:3.2.7-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygem-xmlrpc 0:0.3.0-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygems 0:2.7.6.3-111.module+el8.9.0+90042+a65659a6
Oracle Linux · 8 rubygems-devel 0:2.7.6.3-111.module+el8.9.0+90042+a65659a6

Vulnerabilities 4

  • High 8.8

    HTTP response splitting in CGI

    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

  • High 7.5

    Ruby Time component ReDoS issue

    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are …

  • Medium 5.3

    Ruby URI component ReDoS issue

    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…

  • Unscored —

    There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occ…