Red Hat Security Advisory

RHSA-2023:3291

rh-ruby27-ruby security, bug fix, and enhancement update

Released 2023-05-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby27-ruby-2.7.8-132.el7, rh-ruby27-ruby-devel-2.7.8-132.el7, rh-ruby27-ruby-doc-2.7.8-132.el7 +19
Red Hat Software Collections for RHEL(v. 7) rh-ruby27-ruby-2.7.8-132.el7, rh-ruby27-ruby-devel-2.7.8-132.el7, rh-ruby27-ruby-doc-2.7.8-132.el7 +19

TI-2021-12996 CVE-2021-33621 · GHSA-vc47-6rqg-c7f5

MEDIUM 43

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02452 Published 2022-11-18 Partial fix · 0.3.5, 0.2.2 +1 CWE-74

TI-2023-13267 CVE-2023-28756 · GHSA-fg7x-g82r-94qc

LOW 35

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02452 Published 2023-03-31 Partial fix · 0.2.2, 0.1.1 CWE-1333

TI-2023-13266 CVE-2023-28755 · GHSA-hv5j-3h9f-99c2

LOW 35

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02637 Published 2023-03-31 Partial fix · 0.12.1, 0.11.1 +2 CWE-1333