Moderate: ruby:2.6 security, bug fix, and enhancement update
Summary
ALSA-2021:2588: Moderate: ruby:2.6 security, bug fix, and enhancement update. Affects rubygem-abrt across 2 version ranges.
< 0.3.0-4.module_el8.5.0+259+8cec6917
< 0.3.0-4.module_el8.5.0+2623+08a8ba32
Fixed in 0.3.0-4.module_el8.5.0+259+8cec6917 or 0.3.0-4.module_el8.5.0+2623+08a8ba32, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
This vulnerability affects the ruby package version 2.6.7. It includes several security issues such as insecure permissions on a directory in /tmp/, NUL injection vulnerability, regular expression denial of service vulnerability, code injection via command argument, unsafe object creation vulnerability in JSON, information disclosure vulnerability, potential HTTP request smuggling, XML round-trip vulnerability, and HTTP response splitting. These vulnerabilities can lead to various consequences including execution of malicious code, information disclosure, and potential HTTP request smuggling.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update rubygem-abrt-
< 0.3.0-4.module_el8.5.0+259+8cec69170.3.0-4.module_el8.5.0+259+8cec6917 -
< 0.3.0-4.module_el8.5.0+2623+08a8ba320.3.0-4.module_el8.5.0+2623+08a8ba32
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
Upgrading the ruby package to version 2.6.7 or later is crucial to address these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for rubygem-abrt →
FAQ
These vulnerabilities can lead to execution of malicious code, information disclosure, and potential HTTP request smuggling.
To fix these vulnerabilities, upgrade the ruby package to version 2.6.7 or later.
No specific workarounds have been mentioned for these vulnerabilities.
More information about these vulnerabilities can be found in the CVE pages listed in the References section.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your manifest file like package-lock.json and Vulert will monitor and alert in real-time for open-source vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for rubygem-abrt.
