Moderate: ruby:3.1 security, bug fix, and enhancement update
Summary
ALSA-2024:1431: Moderate: ruby:3.1 security, bug fix, and enhancement update. Affects ruby versions < 3.1.4-142.module_el8.9.0+3746+91b8233a. Fixed in 3.1.4-142.module_el8.9.0+3746+91b8233a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The vulnerability affects the following packages: ruby, ruby-bundled-gems, ruby-default-gems, ruby-devel, ruby-doc, ruby-libs, rubygem-abrt, rubygem-abrt-doc, rubygem-bigdecimal, rubygem-bundler, rubygem-io-console, rubygem-irb, rubygem-json, rubygem-minitest, rubygem-mysql2, rubygem-mysql2-doc, rubygem-pg, rubygem-pg-doc, rubygem-power_assert, rubygem-psych, rubygem-rake, rubygem-rbs, rubygem-rdoc, rubygem-rexml, rubygem-rss, rubygem-test-unit, rubygem-typeprof, rubygems, rubygems-devel.
Vulnerability Detail
The vulnerability includes multiple security fixes and bug fixes. The security fixes address the following vulnerabilities:
- CVE-2021-33621: HTTP response splitting in CGI
- CVE-2023-28755: ReDoS vulnerability in URI
- CVE-2023-36617: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755
- CVE-2023-28756: ReDoS vulnerability in Time
These vulnerabilities could potentially lead to various security issues, including HTTP response splitting and regular expression denial of service (ReDoS) attacks.
How To Fix
Minimum fixed version
3.1.4-142.module_el8.9.0+3746+91b8233a
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the ruby:3.1 security, bug fix, and enhancement update includes multiple security fixes and bug fixes. These vulnerabilities could potentially lead to security issues such as HTTP response splitting and regular expression denial of service (ReDoS) attacks. It is recommended to upgrade the affected packages to the fixed version: ruby 3.1.4-142.module_el8.9.0+3746+91b8233a. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
These vulnerabilities could potentially lead to security issues such as HTTP response splitting and regular expression denial of service (ReDoS) attacks.
No, there are no known workarounds for these vulnerabilities.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related information, on the CVE pages listed in the References section of the vulnerability details.
To fix these vulnerabilities, it is recommended to upgrade the affected packages to the fixed version: ruby 3.1.4-142.module_el8.9.0+3746+91b8233a.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
