Important: ruby:2.7 security update
Summary
ALSA-2021:3020: Important: ruby:2.7 security update. Affects ruby across 2 version ranges.
< 2.7.4-137.module_el8.4.0+2515+f744ca41
< 2.7.4-137.module_el8.5.0+117+35d1289b
Fixed in 2.7.4-137.module_el8.4.0+2515+f744ca41 or 2.7.4-137.module_el8.5.0+117+35d1289b, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The vulnerability affects the ruby package version 2.7.
Vulnerability Detail
The vulnerability includes the following security issues:
- CVE-2020-36327: Dependencies of gems with explicit source may be installed from a different source.
- CVE-2021-31799: Command injection vulnerability in RDoc.
- CVE-2021-31810: FTP PASV command response can cause Net::FTP to connect to arbitrary host.
- CVE-2021-32066: StartTLS stripping vulnerability in Net::IMAP.
These vulnerabilities can lead to various security risks, including unauthorized access, remote code execution, and information disclosure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update ruby-
< 2.7.4-137.module_el8.4.0+2515+f744ca412.7.4-137.module_el8.4.0+2515+f744ca41 -
< 2.7.4-137.module_el8.5.0+117+35d1289b2.7.4-137.module_el8.5.0+117+35d1289b
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, it is important to update the ruby package to version 2.7.4-137.module_el8.4.0+2515+f744ca41 or later to address the mentioned vulnerabilities. For more information and assistance, you can reach out to DevNack.com.
See every vulnerability recorded for ruby →
FAQ
These vulnerabilities can lead to unauthorized access, remote code execution, and information disclosure.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability.
No specific workarounds have been mentioned for these vulnerabilities.
For more details about the vulnerabilities, including the impact, CVSS score, acknowledgments, and related information, refer to the CVE pages listed in the References section.
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
