Red Hat Security AdvisoryRHSA-2022:6855
rh-ruby30-ruby security, bug fix, and enhancement update
Released 2022-10-11 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby30-ruby-3.0.4-149.el7, rh-ruby30-ruby-default-gems-3.0.4-149.el7, rh-ruby30-ruby-devel-3.0.4-149.el7 +18
- Red Hat Software Collections for RHEL(v. 7) rh-ruby30-ruby-3.0.4-149.el7, rh-ruby30-ruby-default-gems-3.0.4-149.el7, rh-ruby30-ruby-devel-3.0.4-149.el7 +18
Fixes 5 records
Priority MEDIUM 50
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04898 · Published 2022-02-06 · Fixed in 0.3.1, 0.2.1 +1 CWE-190
Priority MEDIUM 48
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03138 · Published 2022-05-09 · Fixed CWE-415
Priority MEDIUM 40
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0437 · Published 2022-05-09 · Partial fix CWE-125
Priority LOW 39
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03151 · Published 2022-01-01 · Partial fix · 0.3.1, 0.2.1 +1 CWE-565
Priority LOW 39
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03463 · Published 2022-01-01 · Partial fix · 3.2.1, 3.1.2 +2 CWE-1333
THREATIST.IORead the docs