Skip to content
OpenAdvisories
Critical RHSA-2018:0583 13 CVEs

Red Hat Security Advisory: rh-ruby22-ruby security, bug fix, and enhancement update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-ruby 0:2.2.9-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-ruby-debuginfo 0:2.2.9-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-ruby-devel 0:2.2.9-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-ruby-doc 0:2.2.9-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-ruby-irb 0:2.2.9-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-ruby-libs 0:2.2.9-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-ruby-tcltk 0:2.2.9-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-bigdecimal 0:1.2.6-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-io-console 0:0.4.3-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-json 0:1.8.1.1-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-minitest 0:5.4.3-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-power_assert 0:0.2.2-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-psych 0:2.0.8.1-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-rake 0:10.4.2-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-rdoc 0:4.2.0-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygem-test-unit 0:3.0.8-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygems 0:2.4.5.4-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6 rh-ruby22-rubygems-devel 0:2.4.5.4-19.el6
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-ruby 0:2.2.9-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-ruby-debuginfo 0:2.2.9-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-ruby-devel 0:2.2.9-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-ruby-doc 0:2.2.9-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-ruby-irb 0:2.2.9-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-ruby-libs 0:2.2.9-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-ruby-tcltk 0:2.2.9-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-bigdecimal 0:1.2.6-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-io-console 0:0.4.3-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-json 0:1.8.1.1-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-minitest 0:5.4.3-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-power_assert 0:0.2.2-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-psych 0:2.0.8.1-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-rake 0:10.4.2-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-rdoc 0:4.2.0-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygem-test-unit 0:3.0.8-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygems 0:2.4.5.4-19.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-ruby22-rubygems-devel 0:2.4.5.4-19.el7

Vulnerabilities 13

  • Critical 9.8
    CVE-2017-0899 EPSS 11%

    RubyGems Code Injection vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • Critical 9.8
    CVE-2017-0903 EPSS 16%

    RubyGems vulnerable to Deserialization of Untrusted Data

    RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remo…

    HackerOne RubyGems ruby2.3 jruby Debian Ubuntu RubyGems
  • High 8.8
    CVE-2017-10784 EPSS 16%

    WEBrick RCE Vulnerability

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user nam…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine RubyGems
  • High 8.1
    CVE-2017-0902

    RubyGems has Origin Validation Error vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-0900

    RubyGems Improper Input Validation vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.

    ruby2.3 ruby jruby ruby1.9.1 Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-0901 Public exploit EPSS 29%

    RubyGems may allow a maliciously crafted gem to overwrite files

    RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-14033

    Ruby OpenSSL DoS Vulnerability

    The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.

    ruby2.3 ruby ruby1.9.1 ruby2.2 Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2009-5147 Public exploit

    DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tai…

    ruby1.9.1 Ubuntu
  • Unscored —
    CVE-2015-7551

    The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.…

    ruby2.0 Ubuntu
  • Unscored —
    CVE-2017-0898

    Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) …

    HackerOne Ruby ruby2.3 ruby Ubuntu Alpine
  • Unscored —
    CVE-2017-14064

    Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate cal…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine
  • Unscored —
    CVE-2017-17405 Public exploit EPSS 74%

    Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and …

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine
  • Unscored —
    CVE-2017-17790

    The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injecti…

    ruby2.3 ruby1.9.1 Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1248935
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1487552
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1487587
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1487588
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1487589
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1487590
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1491866
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1492012
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1492015
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1500488
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1526189
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1528218
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1549646
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0583.json
  • report
    https://access.redhat.com/security/cve/CVE-2009-5147
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-5147
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-5147
  • report
    https://access.redhat.com/security/cve/CVE-2015-7551
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7551
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7551
  • report
    https://access.redhat.com/security/cve/CVE-2017-0898
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-0898
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-0898
  • article
    https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/
  • report
    https://access.redhat.com/security/cve/CVE-2017-0899
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-0899
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-0899
  • article
    http://blog.rubygems.org/2017/08/27/2.6.13-released.html
  • report
    https://access.redhat.com/security/cve/CVE-2017-0900
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-0900
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-0900
  • report
    https://access.redhat.com/security/cve/CVE-2017-0901
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-0901
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-0901
  • report
    https://access.redhat.com/security/cve/CVE-2017-0902
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-0902
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-0902
  • report
    https://access.redhat.com/security/cve/CVE-2017-0903