RHSA-2024:4499 — Red Hat Security Advisory: ruby security update

Fixed packages 46

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby	0:2.5.9-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-debuginfo	0:2.5.9-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-debugsource	0:2.5.9-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-devel	0:2.5.9-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-doc	0:2.5.9-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-irb	0:2.5.9-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-libs	0:2.5.9-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	ruby-libs-debuginfo	0:2.5.9-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-abrt	0:0.3.0-4.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-abrt-doc	0:0.3.0-4.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bigdecimal	0:1.3.4-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bigdecimal-debuginfo	0:1.3.4-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bson	0:4.3.0-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bson-debuginfo	0:4.3.0-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bson-debugsource	0:4.3.0-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bson-doc	0:4.3.0-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bundler	0:1.16.1-4.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-bundler-doc	0:1.16.1-4.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-did_you_mean	0:1.2.0-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-io-console	0:0.4.6-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-io-console-debuginfo	0:0.4.6-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-json	0:2.1.0-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-json-debuginfo	0:2.1.0-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-minitest	0:5.10.3-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mongo	0:2.5.1-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mongo-doc	0:2.5.1-2.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mysql2	0:0.4.10-4.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mysql2-debuginfo	0:0.4.10-4.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mysql2-debugsource	0:0.4.10-4.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-mysql2-doc	0:0.4.10-4.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-net-telnet	0:0.1.1-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-openssl	0:2.1.2-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-openssl-debuginfo	0:2.1.2-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-pg	0:1.0.0-3.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-pg-debuginfo	0:1.0.0-3.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-pg-debugsource	0:1.0.0-3.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-pg-doc	0:1.0.0-3.module+el8.9.0+19193+435404ae
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-power_assert	0:1.1.1-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-psych	0:3.0.2-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-psych-debuginfo	0:3.0.2-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-rake	0:12.3.3-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-rdoc	0:6.0.1.1-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-test-unit	0:3.2.7-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygem-xmlrpc	0:0.3.0-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygems	0:2.7.6.3-112.module+el8.10.0+22021+135c76a8
Red Hat · RHEL 8 enterprise_linux:8::appstream	rubygems-devel	0:2.7.6.3-112.module+el8.10.0+22021+135c76a8

Vulnerabilities 5

Critical 9.8

CVE-2024-27280

StringIO buffer overread vulnerability

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return t…

ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine Wolfi RubyGems

May 8, 2024
Medium 6.6

CVE-2024-27282

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Azure Linux Alpine

May 8, 2024
Medium 5.3

CVE-2023-36617

URI gem has ReDoS vulnerability

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser…

kube-fluentd-operator ruby2.3 ruby2.5 jruby Debian Ubuntu Azure Linux Wolfi RubyGems

Jun 29, 2023
Medium 5.3

CVE-2024-35176 Public exploit

REXML contains a denial of service vulnerability

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.…

ruby rexml kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Wolfi RubyGems

May 16, 2024
Medium 4.5

CVE-2024-27281

RDoc RCE vulnerability with .rdoc_options

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no r…

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Azure Linux Alpine Wolfi RubyGems

May 8, 2024

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=2218614
report
https://bugzilla.redhat.com/show_bug.cgi?id=2270749
report
https://bugzilla.redhat.com/show_bug.cgi?id=2270750
report
https://bugzilla.redhat.com/show_bug.cgi?id=2276810
report
https://bugzilla.redhat.com/show_bug.cgi?id=2280894
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4499.json
report
https://access.redhat.com/security/cve/CVE-2023-36617
advisory
https://www.cve.org/CVERecord?id=CVE-2023-36617
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-36617
article
https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617
report
https://access.redhat.com/security/cve/CVE-2024-27280
advisory
https://www.cve.org/CVERecord?id=CVE-2024-27280
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-27280
article
https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/
report
https://access.redhat.com/security/cve/CVE-2024-27281
advisory
https://www.cve.org/CVERecord?id=CVE-2024-27281
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-27281
article
https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/
report
https://access.redhat.com/security/cve/CVE-2024-27282
advisory
https://www.cve.org/CVERecord?id=CVE-2024-27282
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-27282
article
https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/
report
https://access.redhat.com/security/cve/CVE-2024-35176
advisory
https://www.cve.org/CVERecord?id=CVE-2024-35176
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-35176
article
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
article
https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176

Red Hat Security Advisory: ruby security update

Fixed packages 46

Vulnerabilities 5

StringIO buffer overread vulnerability

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it…

URI gem has ReDoS vulnerability

REXML contains a denial of service vulnerability

RDoc RCE vulnerability with .rdoc_options

References