Red Hat Security AdvisoryRHSA-2020:2212
ruby security update
Released 2020-05-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server AUS (v. 7.4) ruby-2.0.0.648-36.el7_4, ruby-irb-2.0.0.648-36.el7_4, ruby-libs-2.0.0.648-36.el7_4 +6
- Red Hat Enterprise Linux Server E4S (v. 7.4) ruby-2.0.0.648-36.el7_4, ruby-irb-2.0.0.648-36.el7_4, ruby-libs-2.0.0.648-36.el7_4 +6
- Red Hat Enterprise Linux Server Optional AUS (v. 7.4) ruby-devel-2.0.0.648-36.el7_4, ruby-doc-2.0.0.648-36.el7_4, ruby-tcltk-2.0.0.648-36.el7_4 +3
- Red Hat Enterprise Linux Server Optional E4S (v. 7.4) ruby-devel-2.0.0.648-36.el7_4, ruby-doc-2.0.0.648-36.el7_4, ruby-tcltk-2.0.0.648-36.el7_4 +3
- Red Hat Enterprise Linux Server Optional TUS (v. 7.4) ruby-devel-2.0.0.648-36.el7_4, ruby-doc-2.0.0.648-36.el7_4, ruby-tcltk-2.0.0.648-36.el7_4 +3
- Red Hat Enterprise Linux Server TUS (v. 7.4) ruby-2.0.0.648-36.el7_4, ruby-irb-2.0.0.648-36.el7_4, ruby-libs-2.0.0.648-36.el7_4 +6
Fixes 2 records
Priority MEDIUM 43
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-re…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.07529 · Published 2018-04-03 · Partial fix CWE-134
Priority LOW 32
Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.05453 · Published 2018-04-03 · Partial fix CWE-113
