Skip to content
OpenAdvisories
Medium RLSA-2021:2588 9 CVEs

Moderate: ruby:2.6 security, bug fix, and enhancement update

Published Jun 29, 2021 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)

Security Fix(es):

* rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)

* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [Rocky Linux-8] (BZ#1954968)

Fixed packages 14

ReleasePackageFixed in
Rocky Linux · 8 ruby 0:2.6.7-107.module+el8.4.0+593+8d7f9f0c
Rocky Linux · 8 rubygem-abrt 0:0.3.0-4.module+el8.5.0+738+032c9c02
Rocky Linux · 8 rubygem-abrt 0:0.3.0-4.module+el8.3.0+167+5c390590
Rocky Linux · 8 rubygem-abrt 0:0.3.0-4.module+el8.4.0+592+03ff458a
Rocky Linux · 8 rubygem-bson 0:4.5.0-1.module+el8.4.0+593+8d7f9f0c
Rocky Linux · 8 rubygem-bson 0:4.5.0-1.module+el8.4.0+446+80b53620
Rocky Linux · 8 rubygem-mongo 0:2.8.0-1.module+el8.4.0+593+8d7f9f0c
Rocky Linux · 8 rubygem-mongo 0:2.8.0-1.module+el8.4.0+446+80b53620
Rocky Linux · 8 rubygem-mysql2 0:0.5.2-1.module+el8.5.0+738+032c9c02
Rocky Linux · 8 rubygem-mysql2 0:0.5.2-1.module+el8.4.0+446+80b53620
Rocky Linux · 8 rubygem-mysql2 0:0.5.2-1.module+el8.4.0+593+8d7f9f0c
Rocky Linux · 8 rubygem-pg 0:1.1.4-1.module+el8.5.0+738+032c9c02
Rocky Linux · 8 rubygem-pg 0:1.1.4-1.module+el8.4.0+446+80b53620
Rocky Linux · 8 rubygem-pg 0:1.1.4-1.module+el8.4.0+593+8d7f9f0c

Vulnerabilities 9

  • High 7.5
    CVE-2020-10663 Public exploit

    Unsafe object creation in json RubyGem

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

    ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2020-25613 Public exploit

    WEBRick vulnerable to HTTP Request/Response Smuggling

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypa…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2021-28965

    REXML round-trip instability

    The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Azure Linux Alpine RubyGems
  • High 7.0
    CVE-2019-3881

    Insecure path handling in Bundler

    Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable…

    bundler bundler Ubuntu RubyGems
  • Unscored —
    CVE-2019-15845

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

    ruby2.3 ruby ruby2.5 Ubuntu Alpine
  • Unscored —
    CVE-2019-16201

    WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular express…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-16254

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEB…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-16255

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-10933

    An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read…

    ruby ruby2.5 ruby2.7 ruby2.7 Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1651826
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1773728
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1789407
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1789556
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1793683
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1827500
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1833291
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1883623
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1947526
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1952627
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1954968