Moderate: ruby:2.7 security, bug fix, and enhancement update
Summary
ALSA-2021:2584: Moderate: ruby:2.7 security, bug fix, and enhancement update. Affects rubygem-abrt across 3 version ranges.
< 0.4.0-1.module_el8.3.0+6147+d0dfc1e4
< 0.4.0-1.module_el8.4.0+2399+4e3a532a
< 0.4.0-1.module_el8.5.0+118+1ab773e1
Fixed in 0.4.0-1.module_el8.3.0+6147+d0dfc1e4, 0.4.0-1.module_el8.4.0+2399+4e3a532a or 0.4.0-1.module_el8.5.0+118+1ab773e1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The vulnerability affects the ruby package version 2.7.3.
Vulnerability Detail
The vulnerability in ruby version 2.7.3 includes two security issues:
-
Potential HTTP request smuggling in WEBrick (CVE-2020-25613): This vulnerability allows an attacker to smuggle HTTP requests through a WEBrick server, potentially leading to unauthorized access or information disclosure.
-
XML round-trip vulnerability in REXML (CVE-2021-28965): This vulnerability allows an attacker to manipulate XML data in a way that could lead to denial of service or arbitrary code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update rubygem-abrt-
< 0.4.0-1.module_el8.3.0+6147+d0dfc1e40.4.0-1.module_el8.3.0+6147+d0dfc1e4 -
< 0.4.0-1.module_el8.4.0+2399+4e3a532a0.4.0-1.module_el8.4.0+2399+4e3a532a -
< 0.4.0-1.module_el8.5.0+118+1ab773e10.4.0-1.module_el8.5.0+118+1ab773e1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the ruby package version 2.7.3 has been found to have two security vulnerabilities. It is recommended to upgrade to the latest version to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for rubygem-abrt →
FAQ
The potential HTTP request smuggling vulnerability in WEBrick can allow an attacker to bypass security measures and gain unauthorized access to sensitive information or perform malicious actions on the affected system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by the XML round-trip vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for vulnerabilities in real-time.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to upgrade the ruby package to the latest version to mitigate the risk.
The CVSS scores for these vulnerabilities are not mentioned in the provided information. It is advisable to refer to the CVE pages listed in the References section for more details.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related information, on the respective CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for rubygem-abrt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
