Red Hat Security AdvisoryRHSA-2020:1963
ruby security update
Released 2020-04-29 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) ruby-2.0.0.648-36.el7_5, ruby-irb-2.0.0.648-36.el7_5, ruby-libs-2.0.0.648-36.el7_5 +6
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) ruby-devel-2.0.0.648-36.el7_5, ruby-doc-2.0.0.648-36.el7_5, ruby-tcltk-2.0.0.648-36.el7_5 +3
- Red Hat Enterprise Linux Server EUS (v. 7.5) ruby-2.0.0.648-36.el7_5, ruby-irb-2.0.0.648-36.el7_5, ruby-libs-2.0.0.648-36.el7_5 +7
- Red Hat Enterprise Linux Server Optional EUS (v. 7.5) ruby-devel-2.0.0.648-36.el7_5, ruby-doc-2.0.0.648-36.el7_5, ruby-tcltk-2.0.0.648-36.el7_5 +3
Fixes 2 records
Priority MEDIUM 43
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-re…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.07529 · Published 2018-04-03 · Partial fix CWE-134
Priority LOW 32
Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.05453 · Published 2018-04-03 · Partial fix CWE-113
