Important: ruby:2.5 security update
Summary
ALSA-2022:0545: Important: ruby:2.5 security update. Affects ruby versions < 2.5.9-107.module_el8.5.0+2625+ec418553. Fixed in 2.5.9-107.module_el8.5.0+2625+ec418553. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
The vulnerability (CVE-2020-36327) affects the rubygem-bundler package in the Ruby ecosystem. It allows dependencies of gems with explicit source to be installed from a different source. This can potentially lead to the installation of malicious or compromised code, compromising the security and integrity of the system.
How To Fix
Minimum fixed version
2.5.9-107.module_el8.5.0+2625+ec418553
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected packages to the fixed versions as soon as possible.
Conclusion
In conclusion, it is crucial to update the affected packages to the fixed versions to mitigate the risk of potential security incidents. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ruby →
FAQ
This vulnerability allows the installation of potentially malicious or compromised code, which can lead to unauthorized access, data breaches, or other security incidents.
The vulnerability affects the following packages: ruby, ruby-devel, ruby-doc, ruby-irb, ruby-libs, rubygem-abrt, rubygem-abrt-doc, rubygem-bigdecimal, rubygem-bson, rubygem-bson-doc, rubygem-bundler, rubygem-bundler-doc, rubygem-did_you_mean, rubygem-io-console, rubygem-json, rubygem-minitest, rubygem-mongo, rubygem-mongo-doc, rubygem-mysql2, rubygem-mysql2-doc, rubygem-net-telnet, rubygem-openssl, rubygem-pg, rubygem-pg-doc, rubygem-power_assert, rubygem-psych, rubygem-rake, rubygem-rdoc, rubygem-test-unit, rubygem-xmlrpc, rubygems, rubygems-devel.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will analyze and alert you if any open-source vulnerabilities are found.
No, there is no known workaround for this vulnerability. It is essential to update the affected packages to the fixed versions.
You can find more information about this vulnerability, including the impact, CVSS score, acknowledgments, and related details, on the CVE page: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36327.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
