Red Hat Security AdvisoryRHSA-2024:3838
ruby security update
Released 2024-06-11 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) ruby-3.0.7-162.el9_4, ruby-default-gems-3.0.7-162.el9_4, ruby-devel-3.0.7-162.el9_4 +18
- Red Hat Enterprise Linux CRB (v. 9) ruby-doc-3.0.7-162.el9_4
Fixes 6 records
Priority MEDIUM 54
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.
CVSS 3.1MEDIUM 4.5· Local · No auth · User interaction · EPSS 0.01571 · Published 2024-05-08 · Partial fix · 6.3.4.1, 6.4.1.1 +2 CWE-502
Priority MEDIUM 53
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02364 · Published 2024-05-08 · Partial fix · 3.0.1.1 CWE-120
Priority MEDIUM 43
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02452 · Published 2022-11-18 · Partial fix · 0.3.5, 0.2.2 +1 CWE-74
Priority LOW 35
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02452 · Published 2023-03-31 · Partial fix · 0.2.2, 0.1.1 CWE-1333
Priority LOW 35
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02637 · Published 2023-03-31 · Partial fix · 0.12.1, 0.11.1 +2 CWE-1333
Priority LOW 30
An issue was discovered in Ruby 3.x through 3.3.0.
CVSS 3.1MEDIUM 6.6· Local · No auth · User interaction · EPSS 0.00656 · Published 2024-05-08 · Partial fix CWE-125
THREATIST.IORead the docs