Red Hat Security AdvisoryRHSA-2022:0543
ruby:2.6 security update
Released 2022-02-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.i686::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.ppc64le::ruby:2.6 +47
Fixes 6 records
Priority MEDIUM 49
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the inten…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.06307 · Published 2021-04-29 · Partial fix · 2.2.10, 2.2.18
Priority LOW 39
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03151 · Published 2022-01-01 · Partial fix · 0.3.1, 0.2.1 +1 CWE-565
Priority LOW 39
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03463 · Published 2022-01-01 · Partial fix · 3.2.1, 3.1.2 +2 CWE-1333
Priority LOW 38
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.02909 · Published 2021-08-01 · Partial fix CWE-755
Priority LOW 36
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.0148 · Published 2021-07-29 · Partial fix · 6.1.2.1, 6.2.1.1 +1 CWE-78
Priority LOW 32
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.
CVSS 3.1MEDIUM 5.8· Network · No auth · No interaction · EPSS 0.0305 · Published 2021-07-13 · Partial fix
THREATIST.IORead the docs