Important: ruby:2.7 security update
Summary
RLSA-2021:3020: Important: ruby:2.7 security update. Affects ruby versions < 0:2.7.4-137.module+el8.4.0+629+f8f0bf91. Fixed in 0:2.7.4-137.module+el8.4.0+629+f8f0bf91. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the Ruby package:
- CVE-2020-36327: Dependencies of gems with explicit source may be installed from a different source.
- CVE-2021-31799: Command injection vulnerability in RDoc.
- CVE-2021-31810: FTP PASV command response can cause Net::FTP to connect to an arbitrary host.
- CVE-2021-32066: StartTLS stripping vulnerability in Net::IMAP.
These vulnerabilities can lead to various security issues, including arbitrary code execution, command injection, and unauthorized network connections.
How To Fix
Minimum fixed version
0:2.7.4-137.module+el8.4.0+629+f8f0bf91
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is crucial to update the Ruby package to address these vulnerabilities and ensure the security of your system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
Ruby is an extensible, interpreted, object-oriented, scripting language used for processing text files and performing system management tasks.
These vulnerabilities can lead to arbitrary code execution, command injection, and unauthorized network connections, posing a significant security risk.
To fix these vulnerabilities, update the Ruby package to version 2.7.4-137.module+el8.4.0+629+f8f0bf91 or later.
No specific workarounds have been provided for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
