Red Hat Security AdvisoryRHSA-2021:3020
ruby:2.7 security update
Released 2021-08-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64::ruby:2.7, ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.i686::ruby:2.7, ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le::ruby:2.7 +47
Fixes 4 records
Priority MEDIUM 49
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the inten…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.06307 · Published 2021-04-29 · Partial fix · 2.2.10, 2.2.18
Priority LOW 38
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.02909 · Published 2021-08-01 · Partial fix CWE-755
Priority LOW 36
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.0148 · Published 2021-07-29 · Partial fix · 6.1.2.1, 6.2.1.1 +1 CWE-78
Priority LOW 32
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.
CVSS 3.1MEDIUM 5.8· Network · No auth · No interaction · EPSS 0.0305 · Published 2021-07-13 · Partial fix
