Moderate: ruby:2.5 security update
Summary
ALSA-2022:0672: Moderate: ruby:2.5 security update. Affects ruby across 2 version ranges.
< 2.5.9-109.module_el8.5.0+259+8cec6917
< 2.5.9-109.module_el8.5.0+2627+d9c243ca
Fixed in 2.5.9-109.module_el8.5.0+259+8cec6917 or 2.5.9-109.module_el8.5.0+2627+d9c243ca, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
This vulnerability affects the Ruby package version 2.5. The following security issues have been identified:
- Command injection vulnerability in RDoc (CVE-2021-31799)
- FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)
- StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)
These vulnerabilities can potentially lead to unauthorized command execution, arbitrary connection to hosts, and StartTLS stripping attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update ruby-
< 2.5.9-109.module_el8.5.0+259+8cec69172.5.9-109.module_el8.5.0+259+8cec6917 -
< 2.5.9-109.module_el8.5.0+2627+d9c243ca2.5.9-109.module_el8.5.0+2627+d9c243ca
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the Ruby package version 2.5 is affected by multiple security vulnerabilities. It is crucial to update to the fixed version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ruby →
FAQ
These vulnerabilities can allow attackers to execute unauthorized commands, establish arbitrary connections, and perform StartTLS stripping attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update the Ruby package to the fixed version.
You can find more information about these vulnerabilities, including the impact, CVSS score, acknowledgments, and related details, on the respective CVE pages: CVE-2021-31799, CVE-2021-31810, and CVE-2021-32066.
To update the Ruby package, you can use the package manager or package management tools specific to your operating system. Refer to the documentation or support resources for your OS for detailed instructions.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
