Moderate: ruby:2.5 security update
Summary
ALSA-2023:7025: Moderate: ruby:2.5 security update. Affects ruby versions < 2.5.9-111.module_el8.9.0+3635+c6f99506. Fixed in 2.5.9-111.module_el8.9.0+3635+c6f99506. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
This vulnerability affects the Ruby package version 2.5. It includes the following security issues:
- HTTP response splitting in CGI (CVE-2021-33621)
- Buffer overrun in String-to-Float conversion (CVE-2022-28739)
- ReDoS vulnerability in URI (CVE-2023-28755)
- ReDoS vulnerability in Time (CVE-2023-28756)
These vulnerabilities can lead to various security risks, including HTTP response splitting, buffer overruns, and regular expression denial of service (ReDoS) attacks.
How To Fix
Minimum fixed version
2.5.9-111.module_el8.9.0+3635+c6f99506
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating the Ruby package to version 2.5.9-111.module_el8.9.0+3635+c6f99506 or later is crucial to mitigate the identified vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ruby →
FAQ
These vulnerabilities can allow attackers to manipulate HTTP responses, cause buffer overruns, and launch regular expression denial of service attacks.
At the time of this advisory, there are no known exploits for these vulnerabilities.
No specific workaround has been provided for these vulnerabilities. It is recommended to update to the latest version of the Ruby package.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will provide real-time alerts for open-source vulnerabilities.
You can find more information about these vulnerabilities, including their impact and CVSS scores, on the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
