Red Hat Security Advisory

RHSA-2022:6585

ruby security, bug fix, and enhancement update

Released 2022-09-20 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) ruby-doc-3.0.4-160.el9_0
Red Hat Enterprise Linux AppStream (v. 9) ruby-3.0.4-160.el9_0, ruby-default-gems-3.0.4-160.el9_0, ruby-devel-3.0.4-160.el9_0 +18

TI-2022-11372 CVE-2022-28738 · GHSA-8pqg-8p79-j5j8

MEDIUM 48

A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03138 Published 2022-05-09 Fixed CWE-415

TI-2022-11373 CVE-2022-28739 · GHSA-mvgc-rxvg-hqc6

MEDIUM 40

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0437 Published 2022-05-09 Partial fix CWE-125