Red Hat Security AdvisoryRHSA-2021:2230
rh-ruby26-ruby security, bug fix, and enhancement update
Released 2021-06-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
Fixes 9 records
Priority MEDIUM 43
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06811 · Published 2020-04-28 · Partial fix · 2.3.0 CWE-20
Priority MEDIUM 42
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.04187 · Published 2019-11-26 · Partial fix CWE-94
Priority MEDIUM 41
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05061 · Published 2021-04-21 · Partial fix · 3.2.5 CWE-115
Priority MEDIUM 41
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05086 · Published 2019-11-26 · Partial fix CWE-287
Priority LOW 39
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03818 · Published 2020-10-06 · Partial fix · 1.6.1, 1.5.1 +1 CWE-444
Priority LOW 35
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.03289 · Published 2019-11-26 · Partial fix
Priority LOW 35
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00529 · Published 2020-09-04 · Partial fix · 2.1.0 CWE-427
Priority LOW 31
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.04569 · Published 2019-11-26 · Partial fix CWE-74
Priority LOW 29
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02525 · Published 2020-05-04 · Fixed CWE-908
THREATIST.IORead the docs