RHSA-2022:0582 — Red Hat Security Advisory: ruby:2.6 security update

Fixed packages 45

Release	Package	Fixed in
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	ruby	0:2.6.9-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	ruby-debuginfo	0:2.6.9-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	ruby-debugsource	0:2.6.9-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	ruby-devel	0:2.6.9-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	ruby-doc	0:2.6.9-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	ruby-libs	0:2.6.9-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	ruby-libs-debuginfo	0:2.6.9-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-abrt	0:0.3.0-4.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-abrt-doc	0:0.3.0-4.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-bigdecimal	0:1.4.1-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-bigdecimal-debuginfo	0:1.4.1-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-bson	0:4.5.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-bson-debuginfo	0:4.5.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-bson-debugsource	0:4.5.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-bson-doc	0:4.5.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-bundler	0:1.17.2-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-did_you_mean	0:1.3.0-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-io-console	0:0.4.7-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-io-console-debuginfo	0:0.4.7-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-irb	0:1.0.0-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-json	0:2.1.0-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-json-debuginfo	0:2.1.0-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-minitest	0:5.11.3-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-mongo	0:2.8.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-mongo-doc	0:2.8.0-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-mysql2	0:0.5.2-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-mysql2-debuginfo	0:0.5.2-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-mysql2-debugsource	0:0.5.2-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-mysql2-doc	0:0.5.2-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-net-telnet	0:0.2.0-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-openssl	0:2.1.2-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-openssl-debuginfo	0:2.1.2-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-pg	0:1.1.4-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-pg-debuginfo	0:1.1.4-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-pg-debugsource	0:1.1.4-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-pg-doc	0:1.1.4-1.module+el8.1.0+3653+beb38eb0
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-power_assert	0:1.1.3-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-psych	0:3.1.0-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-psych-debuginfo	0:3.1.0-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-rake	0:12.3.3-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-rdoc	0:6.1.2.1-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-test-unit	0:3.2.9-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygem-xmlrpc	0:0.3.0-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygems	0:3.0.3.1-107.module+el8.2.0+14086+86d863af
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	rubygems-devel	0:3.0.3.1-107.module+el8.2.0+14086+86d863af

Vulnerabilities 14

High 8.8

CVE-2020-36327

Dependency Confusion in Bundler

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a …

rubygems bundler bundler Debian Ubuntu RubyGems

Apr 29, 2021
High 7.5

CVE-2020-10663 Public exploit

Unsafe object creation in json RubyGem

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems

Apr 28, 2020
High 7.5

CVE-2020-25613 Public exploit

WEBRick vulnerable to HTTP Request/Response Smuggling

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems

Oct 6, 2020
High 7.5

CVE-2021-28965

REXML round-trip instability

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems

Apr 21, 2021
High 7.5

CVE-2021-41817

Regular expression denial of service vulnerability (ReDoS) in date

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems

Jan 1, 2022
High 7.5

CVE-2021-41819

Cookie Prefix Spoofing in CGI::Cookie.parse

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems

Jan 1, 2022
High 7.0

CVE-2021-31799

Arbitrary Code Execution in Rdoc

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems

Jul 29, 2021
Unscored —

CVE-2019-15845

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

ruby2.3 ruby ruby2.5 Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16201

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16254

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine

Nov 26, 2019
Unscored —

CVE-2020-10933

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine

May 4, 2020
Unscored —

CVE-2021-31810

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine

Jul 13, 2021
Unscored —

CVE-2021-32066

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine

Aug 1, 2021

References

article
https://access.redhat.com/security/updates/classification/#important
article
https://access.redhat.com/articles/6206172
report
https://bugzilla.redhat.com/show_bug.cgi?id=1773728
report
https://bugzilla.redhat.com/show_bug.cgi?id=1789407
report
https://bugzilla.redhat.com/show_bug.cgi?id=1789556
report
https://bugzilla.redhat.com/show_bug.cgi?id=1793683
report
https://bugzilla.redhat.com/show_bug.cgi?id=1827500
report
https://bugzilla.redhat.com/show_bug.cgi?id=1833291
report
https://bugzilla.redhat.com/show_bug.cgi?id=1883623
report
https://bugzilla.redhat.com/show_bug.cgi?id=1947526
report
https://bugzilla.redhat.com/show_bug.cgi?id=1958999
report
https://bugzilla.redhat.com/show_bug.cgi?id=1980126
report
https://bugzilla.redhat.com/show_bug.cgi?id=1980128
report
https://bugzilla.redhat.com/show_bug.cgi?id=1980132
report
https://bugzilla.redhat.com/show_bug.cgi?id=2025104
report
https://bugzilla.redhat.com/show_bug.cgi?id=2026757
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0582.json
report
https://access.redhat.com/security/cve/CVE-2019-15845
advisory
https://www.cve.org/CVERecord?id=CVE-2019-15845
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15845
article
https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/
report
https://access.redhat.com/security/cve/CVE-2019-16201
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16201
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16201
article
https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
report
https://access.redhat.com/security/cve/CVE-2019-16254
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16254
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16254
report
https://access.redhat.com/security/cve/CVE-2019-16255
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16255
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16255
report
https://access.redhat.com/security/cve/CVE-2020-10663
advisory
https://www.cve.org/CVERecord?id=CVE-2020-10663
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-10663
article
https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663
report
https://access.redhat.com/security/cve/CVE-2020-10933
advisory
https://www.cve.org/CVERecord?id=CVE-2020-10933
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-10933
article
https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933

Red Hat Security Advisory: ruby:2.6 security update

Fixed packages 45

Vulnerabilities 14

Dependency Confusion in Bundler

Unsafe object creation in json RubyGem

WEBRick vulnerable to HTTP Request/Response Smuggling

REXML round-trip instability

Regular expression denial of service vulnerability (ReDoS) in date

Cookie Prefix Spoofing in CGI::Cookie.parse

Arbitrary Code Execution in Rdoc

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …

References