Vulnerability in ruby1.9.1 - Multiple Security Issues
Summary
DLA-1114-1: ruby1.9.1 - security update. Affects ruby1.9.1 versions < 1.9.3.194-8.1+deb7u6. Fixed in 1.9.3.194-8.1+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby1.9.1 is an open-source programming language that provides a flexible and dynamic environment for developing various applications. It is widely used for web development, scripting, and automation tasks. However, multiple security vulnerabilities have been discovered in the Ruby 1.9 interpreter, impacting the ruby1.9.1 package in Debian 7 Wheezy.
Vulnerability Detail
The vulnerabilities in Ruby 1.9.1 include:
- CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf
- CVE-2017-0899: ANSI escape sequence vulnerability
- CVE-2017-0900: Denial of Service (DoS) vulnerability in the query command
- CVE-2017-0901: Malicious gem installer allows overwriting arbitrary files
- CVE-2017-10784: Escape sequence injection vulnerability in Basic authentication of WEBrick
- CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode
- CVE-2017-14064: Heap exposure vulnerability in generating JSON
These vulnerabilities can lead to various security issues, including remote code execution, denial of service, and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.9.3.194-8.1+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby1.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple security vulnerabilities have been discovered in the Ruby 1.9 interpreter, affecting the ruby1.9.1 package in Debian 7 Wheezy. To mitigate these vulnerabilities, it is crucial to upgrade the ruby1.9.1 package to version 1.9.3.194-8.1+deb7u6. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby1.9.1 →
FAQ
These vulnerabilities can allow attackers to execute arbitrary code, cause denial of service, or gain unauthorized access to sensitive information.
Yes, all versions of ruby1.9.1 in Debian 7 Wheezy are affected by these vulnerabilities.
No specific workaround has been provided. It is recommended to upgrade the ruby1.9.1 package to the fixed version.
Yes, some of these vulnerabilities can be exploited remotely, potentially allowing attackers to compromise vulnerable systems over a network.
There is no specific information available regarding active exploits targeting these vulnerabilities at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for ruby1.9.1.
