Red Hat Security AdvisoryRHSA-2009:1140
ruby security update
Released 2009-07-02 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) ruby-1.8.5-5.el5_3.7, ruby-1.8.5-5.el5_3.7.i386, ruby-1.8.5-5.el5_3.7.ia64 +33
- Red Hat Enterprise Linux AS version 4 irb-1.8.1-7.el4_8.3, irb-1.8.1-7.el4_8.3.i386, irb-1.8.1-7.el4_8.3.ia64 +25
- Red Hat Enterprise Linux Desktop (v. 5 client) ruby-1.8.5-5.el5_3.7, ruby-1.8.5-5.el5_3.7.i386, ruby-docs-1.8.5-5.el5_3.7 +11
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) ruby-1.8.5-5.el5_3.7, ruby-devel-1.8.5-5.el5_3.7, ruby-devel-1.8.5-5.el5_3.7.i386 +2
- Red Hat Enterprise Linux Desktop version 4 irb-1.8.1-7.el4_8.3, irb-1.8.1-7.el4_8.3.i386, ruby-1.8.1-7.el4_8.3 +11
- Red Hat Enterprise Linux ES version 4 irb-1.8.1-7.el4_8.3, irb-1.8.1-7.el4_8.3.i386, irb-1.8.1-7.el4_8.3.ia64 +18
- Red Hat Enterprise Linux WS version 4 irb-1.8.1-7.el4_8.3, irb-1.8.1-7.el4_8.3.i386, irb-1.8.1-7.el4_8.3.ia64 +18
Fixes 3 records
Priority LOW 37
The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstr…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.12775 · Published 2009-06-11 · Fixed CWE-189
Priority LOW 35
ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.0264 · Published 2009-02-18 · Fixed CWE-287
Priority LOW 18
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions.
CVSS 2.0LOW 2.6· Network · No auth · Interaction — · EPSS 0.02423 · Published 2007-04-16 · Fixed
