Moderate: ruby:3.0 security update
Summary
ALSA-2024:3500: Moderate: ruby:3.0 security update. Affects ruby versions < 3.0.7-143.module_el8.10.0+3852+ce828b19. Fixed in 3.0.7-143.module_el8.10.0+3852+ce828b19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
This vulnerability affects the Ruby package version 3.0. The following security issues have been identified:
- HTTP response splitting in CGI (CVE-2021-33621)
- ReDoS vulnerability in URI (CVE-2023-28755)
- ReDoS vulnerability in Time (CVE-2023-28756)
- RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
- Buffer overread vulnerability in StringIO (CVE-2024-27280)
- Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)
These vulnerabilities can lead to various security risks, including remote code execution, denial of service, and information disclosure.
How To Fix
Minimum fixed version
3.0.7-143.module_el8.10.0+3852+ce828b19
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating the Ruby package to version 3.0.7-143.module_el8.10.0+3852+ce828b19 or later is crucial to mitigate the identified security vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
Ruby is an interpreted, object-oriented scripting language known for its simplicity and flexibility.
HTTP response splitting is a vulnerability that allows an attacker to inject arbitrary HTTP headers into a response, potentially leading to various attacks such as cross-site scripting (XSS) or cache poisoning.
A ReDoS (Regular Expression Denial of Service) vulnerability occurs when a regular expression pattern can be exploited to cause the matching algorithm to enter an infinite loop, leading to a denial of service condition.
An RCE (Remote Code Execution) vulnerability allows an attacker to execute arbitrary code on a remote system, potentially leading to full control over the affected system.
A buffer overread vulnerability occurs when a program reads data from a buffer beyond its boundaries, potentially exposing sensitive information or causing a crash.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
