Red Hat Security Advisory: rh-ruby26-ruby security, bug fix, and enhancement update

Fixed packages 22

Vulnerabilities 6

• High 8.8
  CVE-2020-36327

  Dependency Confusion in Bundler

  Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a …

  rubygems bundler bundler Debian Ubuntu RubyGems
  Apr 29, 2021
• High 7.5
  CVE-2021-41817

  Regular expression denial of service vulnerability (ReDoS) in date

  Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Jan 1, 2022
• High 7.5
  CVE-2021-41819

  Cookie Prefix Spoofing in CGI::Cookie.parse

  CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  Jan 1, 2022
• High 7.0
  CVE-2021-31799

  Arbitrary Code Execution in Rdoc

  In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  Jul 29, 2021
• Unscored —
  CVE-2021-31810

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can u…

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine
  Jul 13, 2021
• Unscored —
  CVE-2021-32066

  An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an …

  ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine
  Aug 1, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/articles/6206172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1958999
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980126
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980128
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2025104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2026757
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0708.json
• report
  https://access.redhat.com/security/cve/CVE-2020-36327
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36327
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36327
• article
  https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/
• report
  https://access.redhat.com/security/cve/CVE-2021-31799
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-31799
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-31799
• article
  https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/
• report
  https://access.redhat.com/security/cve/CVE-2021-31810
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-31810
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-31810
• article
  https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/
• report
  https://access.redhat.com/security/cve/CVE-2021-32066
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-32066
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-32066
• article
  https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/
• report
  https://access.redhat.com/security/cve/CVE-2021-41817
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-41817
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-41817
• article
  https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/
• report
  https://access.redhat.com/security/cve/CVE-2021-41819
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-41819
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-41819