Security Update for ruby2.5
Summary
DLA-3450-1: ruby2.5 - security update. Affects ruby2.5 versions < 2.5.5-3+deb10u6. Fixed in 2.5.5-3+deb10u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby2.5 is an interpreter for the Ruby programming language. It is widely used for web development and other applications. The vulnerability affects version 2.5.5-3+deb10u6 of the package in Debian 10 buster.
Vulnerability Detail
The vulnerability, identified as CVE-2021-33621, arises from Ruby's mishandling of user input in applications that generate HTTP responses using the cgi gem. This flaw could allow an attacker to modify the response received by a user from a vulnerable application. Another vulnerability, CVE-2022-28739, involves Ruby incorrectly handling certain inputs, potentially leading to the exposure of sensitive information.
How To Fix
Minimum fixed version
2.5.5-3+deb10u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
It is crucial to promptly upgrade your ruby2.5 packages to address these security vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ruby2.5 →
FAQ
Ruby2.5 is an interpreter for the Ruby programming language, commonly used for web development and other applications.
CVE-2021-33621 allows an attacker to maliciously modify the response received by a user from a vulnerable application.
CVE-2022-28739 can lead to the exposure of sensitive information.
To fix the vulnerability, upgrade your ruby2.5 packages to version 2.5.5-3+deb10u6 or later.
You can find more information about ruby2.5 security on its security tracker page: https://security-tracker.debian.org/tracker/ruby2.5
Related vulnerabilities
Recent vulnerabilities recorded for ruby2.5.
