Red Hat Security Advisory: ruby:2.6 security update

Fixed packages 45

Vulnerabilities 14

• High 8.8
  CVE-2020-36327

  Dependency Confusion in Bundler

  Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a …

  rubygems bundler bundler Debian Ubuntu RubyGems
  Apr 29, 2021
• High 7.5
  CVE-2020-10663 Public exploit

  Unsafe object creation in json RubyGem

  The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

  ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  Apr 28, 2020
• High 7.5
  CVE-2020-25613 Public exploit

  WEBRick vulnerable to HTTP Request/Response Smuggling

  An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  Oct 6, 2020
• High 7.5
  CVE-2021-28965

  REXML round-trip instability

  The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Apr 21, 2021
• High 7.5
  CVE-2021-41817

  Regular expression denial of service vulnerability (ReDoS) in date

  Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Jan 1, 2022
• High 7.5
  CVE-2021-41819

  Cookie Prefix Spoofing in CGI::Cookie.parse

  CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Jan 1, 2022
• High 7.0
  CVE-2021-31799

  Arbitrary Code Execution in Rdoc

  In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  Jul 29, 2021
• Unscored —
  CVE-2019-15845

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

  ruby2.3 ruby ruby2.5 Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2019-16201

  WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2019-16254

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2019-16255

  Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

  ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  Nov 26, 2019
• Unscored —
  CVE-2020-10933

  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

  ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine
  May 4, 2020
• Unscored —
  CVE-2021-31810

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine
  Jul 13, 2021
• Unscored —
  CVE-2021-32066

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine
  Aug 1, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/articles/6206172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1773728
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1789407
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1789556
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1793683
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1827500
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1833291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883623
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1947526
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1958999
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980126
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980128
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2025104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2026757
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0581.json
• report
  https://access.redhat.com/security/cve/CVE-2019-15845
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-15845
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-15845
• article
  https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/
• report
  https://access.redhat.com/security/cve/CVE-2019-16201
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16201
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16201
• article
  https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
• report
  https://access.redhat.com/security/cve/CVE-2019-16254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16254
• report
  https://access.redhat.com/security/cve/CVE-2019-16255
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16255
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16255
• report
  https://access.redhat.com/security/cve/CVE-2020-10663
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10663
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10663
• article
  https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663
• report
  https://access.redhat.com/security/cve/CVE-2020-10933
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10933
• article
  https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933