Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update

Fixed packages 21

Vulnerabilities 8

• High 7.5
  CVE-2020-10663 Public exploit

  Unsafe object creation in json RubyGem

  The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

  ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  Apr 28, 2020
• High 7.5
  CVE-2020-25613 Public exploit

  WEBRick vulnerable to HTTP Request/Response Smuggling

  An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  Oct 6, 2020
• High 7.5
  CVE-2021-28965

  REXML round-trip instability

  The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Apr 21, 2021
• Unscored —
  CVE-2019-15845

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

  ruby2.3 ruby ruby2.5 Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2019-16201

  WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2019-16254

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2019-16255

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2020-10933

  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

  ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine
  May 4, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1773728
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1789407
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1789556
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1793683
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1827500
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1833291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883623
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1947526
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1952998
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2104.json
• report
  https://access.redhat.com/security/cve/CVE-2019-15845
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-15845
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-15845
• article
  https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/
• report
  https://access.redhat.com/security/cve/CVE-2019-16201
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16201
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16201
• article
  https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
• report
  https://access.redhat.com/security/cve/CVE-2019-16254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16254
• report
  https://access.redhat.com/security/cve/CVE-2019-16255
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16255
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16255
• report
  https://access.redhat.com/security/cve/CVE-2020-10663
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10663
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10663
• article
  https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663
• report
  https://access.redhat.com/security/cve/CVE-2020-10933
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10933
• article
  https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933
• report
  https://access.redhat.com/security/cve/CVE-2020-25613
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25613
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25613
• article
  https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/
• report
  https://access.redhat.com/security/cve/CVE-2021-28965
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28965