Skip to content
OpenAdvisories
High RHSA-2020:2769 6 CVEs

Red Hat Security Advisory: ruby security update

Published Sep 13, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 48

ReleasePackageFixed in
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server ruby 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server ruby-debuginfo 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server ruby-devel 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server ruby-doc 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server ruby-irb 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server ruby-libs 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server ruby-tcltk 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygem-bigdecimal 0:1.2.0-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygem-io-console 0:0.4.2-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygem-json 0:1.7.7-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygem-minitest 0:4.3.2-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygem-psych 0:2.0.0-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygem-rake 0:0.9.6-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygem-rdoc 0:4.0.0-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygems 0:2.0.14.1-37.el7_4
Red Hat · RHEL 7.4 AUS rhel_aus:7.4::server rubygems-devel 0:2.0.14.1-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server ruby 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server ruby-debuginfo 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server ruby-devel 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server ruby-doc 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server ruby-irb 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server ruby-libs 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server ruby-tcltk 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygem-bigdecimal 0:1.2.0-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygem-io-console 0:0.4.2-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygem-json 0:1.7.7-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygem-minitest 0:4.3.2-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygem-psych 0:2.0.0-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygem-rake 0:0.9.6-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygem-rdoc 0:4.0.0-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygems 0:2.0.14.1-37.el7_4
Red Hat · RHEL 7.4 E4S rhel_e4s:7.4::server rubygems-devel 0:2.0.14.1-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server ruby 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server ruby-debuginfo 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server ruby-devel 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server ruby-doc 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server ruby-irb 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server ruby-libs 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server ruby-tcltk 0:2.0.0.648-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygem-bigdecimal 0:1.2.0-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygem-io-console 0:0.4.2-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygem-json 0:1.7.7-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygem-minitest 0:4.3.2-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygem-psych 0:2.0.0-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygem-rake 0:0.9.6-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygem-rdoc 0:4.0.0-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygems 0:2.0.14.1-37.el7_4
Red Hat · RHEL 7.4 TUS rhel_tus:7.4::server rubygems-devel 0:2.0.14.1-37.el7_4

Vulnerabilities 6

  • High 8.8
    CVE-2019-8324

    Code injection in RubyGems

    An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec du…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2019-8321

    RubyGems Escape sequence injection vulnerability in verbose

    An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2019-8322

    RubyGems Escape sequence injection vulnerability in gem owner

    An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2019-8323

    RubyGems Escape sequence injection vulnerability in api response handling

    An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2019-8325

    RubyGems Escape sequence injection in errors

    An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2018-16396

    An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. …

    ruby2.3 ruby ruby2.5 ruby2.0 Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1643089
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1692514
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1692516
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1692519
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1692520
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1692522
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2769.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-16396
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-16396
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-16396
  • article
    https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/
  • report
    https://access.redhat.com/security/cve/CVE-2019-8321
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-8321
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-8321
  • report
    https://access.redhat.com/security/cve/CVE-2019-8322
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-8322
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-8322
  • report
    https://access.redhat.com/security/cve/CVE-2019-8323
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-8323
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-8323
  • report
    https://access.redhat.com/security/cve/CVE-2019-8324
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-8324
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-8324
  • article
    https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
  • article
    https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/
  • report
    https://access.redhat.com/security/cve/CVE-2019-8325
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-8325
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-8325