Vulnerability in Ruby1.8 and Ruby1.9
Summary
DSA-1860-1: ruby1.8 ruby1.9 - several issues. Affects ruby1.9 versions < 1.9.0+20060609-1etch5. Fixed in 1.9.0+20060609-1etch5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language known for its simplicity and productivity. It is widely used for web development, scripting, and automation tasks. Ruby1.8 and Ruby1.9 are specific versions of Ruby that are affected by several vulnerabilities.
Vulnerability Detail
The vulnerabilities in Ruby1.8 and Ruby1.9 include:
-
CVE-2009-0642: The return value from the OCSP_basic_verify function was not checked properly, allowing continued use of a revoked certificate.
-
CVE-2009-1904: An issue in parsing BigDecimal numbers can result in a denial-of-service condition (crash).
These vulnerabilities can potentially lead to unauthorized access, data breaches, or denial-of-service attacks.
How To Fix
Minimum fixed version
1.9.0+20060609-1etch5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby1.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading your Ruby packages to the fixed versions is crucial to ensure the security and stability of your software. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ruby1.9 →
FAQ
Ruby is a dynamic, open-source programming language known for its simplicity and productivity. It is widely used for web development, scripting, and automation tasks.
Ruby1.8 and Ruby1.9 are specific versions of Ruby that are affected by several vulnerabilities.
CVE-2009-0642 is a vulnerability in Ruby1.8 and Ruby1.9 where the return value from the OCSP_basic_verify function was not checked properly, allowing continued use of a revoked certificate.
CVE-2009-1904 is a vulnerability in Ruby1.8 and Ruby1.9 where an issue in parsing BigDecimal numbers can result in a denial-of-service condition (crash).
To fix these vulnerabilities, it is recommended to upgrade your Ruby packages to the fixed versions mentioned earlier.
Related vulnerabilities
Recent vulnerabilities recorded for ruby1.9.
