Skip to content
OpenAdvisories
High RHSA-2021:2588 9 CVEs

Red Hat Security Advisory: ruby:2.6 security, bug fix, and enhancement update

Published Oct 21, 2024 · Updated Aug 9, 2026

Ecosystem: Red Hat

Fixed packages 45

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby 0:2.6.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-debuginfo 0:2.6.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-debugsource 0:2.6.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-devel 0:2.6.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-doc 0:2.6.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-libs 0:2.6.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream ruby-libs-debuginfo 0:2.6.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-abrt 0:0.3.0-4.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-abrt-doc 0:0.3.0-4.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bigdecimal 0:1.4.1-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bigdecimal-debuginfo 0:1.4.1-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bson 0:4.5.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bson-debuginfo 0:4.5.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bson-debugsource 0:4.5.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bson-doc 0:4.5.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bundler 0:1.17.2-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-did_you_mean 0:1.3.0-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-io-console 0:0.4.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-io-console-debuginfo 0:0.4.7-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-irb 0:1.0.0-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-json 0:2.1.0-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-json-debuginfo 0:2.1.0-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-minitest 0:5.11.3-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mongo 0:2.8.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mongo-doc 0:2.8.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mysql2 0:0.5.2-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mysql2-debuginfo 0:0.5.2-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mysql2-debugsource 0:0.5.2-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-mysql2-doc 0:0.5.2-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-net-telnet 0:0.2.0-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-openssl 0:2.1.2-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-openssl-debuginfo 0:2.1.2-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-pg 0:1.1.4-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-pg-debuginfo 0:1.1.4-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-pg-debugsource 0:1.1.4-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-pg-doc 0:1.1.4-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-power_assert 0:1.1.3-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-psych 0:3.1.0-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-psych-debuginfo 0:3.1.0-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-rake 0:12.3.3-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-rdoc 0:6.1.2-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-test-unit 0:3.2.9-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-xmlrpc 0:0.3.0-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygems 0:3.0.3.1-107.module+el8.4.0+10830+bbd85cce
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygems-devel 0:3.0.3.1-107.module+el8.4.0+10830+bbd85cce

Vulnerabilities 9

  • High 7.5
    CVE-2020-10663 Public exploit

    Unsafe object creation in json RubyGem

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

    ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2020-25613 Public exploit

    WEBRick vulnerable to HTTP Request/Response Smuggling

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2021-28965

    REXML round-trip instability

    The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  • High 7.0
    CVE-2019-3881

    Insecure path handling in Bundler

    Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable…

    bundler bundler Ubuntu RubyGems
  • Unscored —
    CVE-2019-15845

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

    ruby2.3 ruby ruby2.5 Ubuntu Alpine
  • Unscored —
    CVE-2019-16201

    WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-16254

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-16255

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-10933

    An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

    ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1651826
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1773728
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1789407
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1789556
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1793683
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1827500
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1833291
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1883623
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1947526
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1952627
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1954968
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2588.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-3881
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-3881
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-3881
  • report
    https://access.redhat.com/security/cve/CVE-2019-15845
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-15845
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-15845
  • article
    https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/
  • report
    https://access.redhat.com/security/cve/CVE-2019-16201
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16201
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16201
  • article
    https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
  • report
    https://access.redhat.com/security/cve/CVE-2019-16254
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16254
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16254
  • report
    https://access.redhat.com/security/cve/CVE-2019-16255
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16255
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16255
  • report
    https://access.redhat.com/security/cve/CVE-2020-10663
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-10663
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-10663
  • article
    https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663
  • report
    https://access.redhat.com/security/cve/CVE-2020-10933
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-10933
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-10933
  • article
    https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933
  • report
    https://access.redhat.com/security/cve/CVE-2020-25613