Red Hat Security Advisory

RHSA-2024:1576

ruby:3.1 security, bug fix, and enhancement update

Released 2024-04-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) ruby-3.1.4-143.module+el9.3.0+21558+96b51efd.aarch64::ruby:3.1, ruby-3.1.4-143.module+el9.3.0+21558+96b51efd.i686::ruby:3.1, ruby-3.1.4-143.module+el9.3.0+21558+96b51efd.ppc64le::ruby:3.1 +47

TI-2021-12996 CVE-2021-33621 · GHSA-vc47-6rqg-c7f5

MEDIUM 43

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02452 Published 2022-11-18 Partial fix · 0.3.5, 0.2.2 +1 CWE-74

TI-2023-13267 CVE-2023-28756 · GHSA-fg7x-g82r-94qc

LOW 35

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02452 Published 2023-03-31 Partial fix · 0.2.2, 0.1.1 CWE-1333

TI-2023-13266 CVE-2023-28755 · GHSA-hv5j-3h9f-99c2

LOW 35

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02637 Published 2023-03-31 Partial fix · 0.12.1, 0.11.1 +2 CWE-1333

TI-2023-18437 CVE-2023-36617 · GHSA-hww2-5g85-429m

LOW 27

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01698 Published 2023-06-29 Partial fix · 0.10.3, 0.12.2 +2 CWE-1333