Moderate: Ruby Security Update
Summary
ALSA-2024:4499: Moderate: ruby security update. Affects ruby versions < 2.5.9-112.module_el8.10.0+3871+342e2c2f. Fixed in 2.5.9-112.module_el8.10.0+3871+342e2c2f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
The Ruby package is affected by multiple vulnerabilities:
- ReDoS vulnerability in rubygem-uri due to an incomplete fix for CVE-2023-28755 (CVE-2023-36617).
- Buffer overread vulnerability in StringIO (CVE-2024-27280).
- Remote Code Execution (RCE) vulnerability with .rdoc_options in RDoc (CVE-2024-27281).
- Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282).
- Denial of Service (DoS) vulnerability in REXML when parsing an XML with many
<s in an attribute value (CVE-2024-35176).
These vulnerabilities can lead to various security issues, including remote code execution, information disclosure, and denial of service attacks.
How To Fix
Minimum fixed version
2.5.9-112.module_el8.10.0+3871+342e2c2f
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Ruby package is affected by multiple vulnerabilities that can lead to various security issues. It is crucial to update to the latest version to mitigate these risks.
See every vulnerability recorded for ruby →
FAQ
Ruby is an extensible, interpreted, object-oriented, scripting language known for its simplicity and productivity.
ReDoS stands for Regular Expression Denial of Service. It is a type of vulnerability where a maliciously crafted input can cause the regular expression matching algorithm to exhibit exponential time complexity, leading to denial of service.
A Buffer Overread vulnerability occurs when a program reads data from a buffer beyond its boundaries, potentially exposing sensitive information or causing a crash.
Remote Code Execution is a vulnerability that allows an attacker to execute arbitrary code on a remote system, potentially gaining unauthorized access or control over the system.
Denial of Service is an attack that aims to disrupt the availability of a system or network by overwhelming it with a flood of illegitimate requests or resource-consuming operations.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
