RHSA-2021:2587 — Red Hat Security Advisory: ruby:2.5 security, bug fix, and enhancement update

Fixed packages 46

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby	0:2.5.9-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-debuginfo	0:2.5.9-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-debugsource	0:2.5.9-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-devel	0:2.5.9-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-doc	0:2.5.9-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-irb	0:2.5.9-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-libs	0:2.5.9-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-libs-debuginfo	0:2.5.9-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-abrt	0:0.3.0-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-abrt-doc	0:0.3.0-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bigdecimal	0:1.3.4-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bigdecimal-debuginfo	0:1.3.4-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bson	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bson-debuginfo	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bson-debugsource	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bson-doc	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bundler	0:1.16.1-3.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bundler-doc	0:1.16.1-3.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-did_you_mean	0:1.2.0-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-io-console	0:0.4.6-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-io-console-debuginfo	0:0.4.6-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-json	0:2.1.0-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-json-debuginfo	0:2.1.0-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-minitest	0:5.10.3-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mongo	0:2.5.1-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mongo-doc	0:2.5.1-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mysql2	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mysql2-debuginfo	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mysql2-debugsource	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mysql2-doc	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-net-telnet	0:0.1.1-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-openssl	0:2.1.2-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-openssl-debuginfo	0:2.1.2-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-pg	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-pg-debuginfo	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-pg-debugsource	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-pg-doc	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-power_assert	0:1.1.1-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-psych	0:3.0.2-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-psych-debuginfo	0:3.0.2-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-rake	0:12.3.3-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-rdoc	0:6.0.1.1-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-test-unit	0:3.2.7-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-xmlrpc	0:0.3.0-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygems	0:2.7.6.3-107.module+el8.4.0+10822+fe4fffb1
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygems-devel	0:2.7.6.3-107.module+el8.4.0+10822+fe4fffb1

Vulnerabilities 8

High 7.5

CVE-2020-10663 Public exploit

Unsafe object creation in json RubyGem

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems

Apr 28, 2020
High 7.5

CVE-2020-25613 Public exploit

WEBRick vulnerable to HTTP Request/Response Smuggling

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems

Oct 6, 2020
High 7.5

CVE-2021-28965

REXML round-trip instability

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems

Apr 21, 2021
Unscored —

CVE-2019-15845

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

ruby2.3 ruby ruby2.5 Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16201

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16254

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2020-10933

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine

May 4, 2020

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=1773728
report
https://bugzilla.redhat.com/show_bug.cgi?id=1789407
report
https://bugzilla.redhat.com/show_bug.cgi?id=1789556
report
https://bugzilla.redhat.com/show_bug.cgi?id=1793683
report
https://bugzilla.redhat.com/show_bug.cgi?id=1827500
report
https://bugzilla.redhat.com/show_bug.cgi?id=1833291
report
https://bugzilla.redhat.com/show_bug.cgi?id=1883623
report
https://bugzilla.redhat.com/show_bug.cgi?id=1947526
report
https://bugzilla.redhat.com/show_bug.cgi?id=1952626
report
https://bugzilla.redhat.com/show_bug.cgi?id=1955010
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2587.json
report
https://access.redhat.com/security/cve/CVE-2019-15845
advisory
https://www.cve.org/CVERecord?id=CVE-2019-15845
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15845
article
https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/
report
https://access.redhat.com/security/cve/CVE-2019-16201
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16201
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16201
article
https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
report
https://access.redhat.com/security/cve/CVE-2019-16254
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16254
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16254
report
https://access.redhat.com/security/cve/CVE-2019-16255
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16255
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16255
report
https://access.redhat.com/security/cve/CVE-2020-10663
advisory
https://www.cve.org/CVERecord?id=CVE-2020-10663
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-10663
article
https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663
report
https://access.redhat.com/security/cve/CVE-2020-10933
advisory
https://www.cve.org/CVERecord?id=CVE-2020-10933
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-10933
article
https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933
report
https://access.redhat.com/security/cve/CVE-2020-25613
advisory
https://www.cve.org/CVERecord?id=CVE-2020-25613
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-25613
article
https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/
report
https://access.redhat.com/security/cve/CVE-2021-28965

Red Hat Security Advisory: ruby:2.5 security, bug fix, and enhancement update

Fixed packages 46

Vulnerabilities 8

Unsafe object creation in json RubyGem

WEBRick vulnerable to HTTP Request/Response Smuggling

REXML round-trip instability

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

References