Moderate: Ruby Security, Bug Fix, and Enhancement Update
Summary
ALSA-2022:6585: Moderate: ruby security, bug fix, and enhancement update. Affects ruby versions < 3.0.4-160.el9_0. Fixed in 3.0.4-160.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
This vulnerability (CVE-2022-28738) in Ruby is a double free issue in Regexp compilation. It can be exploited by an attacker to cause a denial of service or potentially execute arbitrary code. Another vulnerability (CVE-2022-28739) is a buffer overrun in String-to-Float conversion, which can also lead to a denial of service or potential code execution.
How To Fix
Minimum fixed version
3.0.4-160.el9_0
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading to the latest version of Ruby (3.0.4) is recommended to fix these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
Ruby is an extensible, interpreted, object-oriented, scripting language.
CVE-2022-28738 can be exploited to cause a denial of service or potentially execute arbitrary code.
CVE-2022-28739 can lead to a denial of service or potential code execution.
To fix these vulnerabilities, upgrade to the latest version of Ruby (3.0.4).
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
