Important: ruby:2.6 security update
Summary
RLSA-2022:0543: Important: ruby:2.6 security update. Affects ruby versions < 0:2.6.9-108.module+el8.5.0+738+032c9c02. Fixed in 0:2.6.9-108.module+el8.5.0+738+032c9c02. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The vulnerability affects the 'ruby' package in Rocky Linux 8.5.0 legacy distribution.
Vulnerability Detail
The vulnerability includes multiple security fixes:
- CVE-2020-36327: Dependencies of gems with explicit source may be installed from a different source.
- CVE-2021-31799: Command injection vulnerability in RDoc.
- CVE-2021-31810: FTP PASV command response can cause Net::FTP to connect to arbitrary host.
- CVE-2021-32066: StartTLS stripping vulnerability in Net::IMAP.
- CVE-2021-41817: Regular expression denial of service vulnerability of Date parsing methods.
- CVE-2021-41819: Cookie prefix spoofing in CGI::Cookie.parse.
These vulnerabilities have the potential to cause various security issues, including arbitrary code execution, command injection, and denial of service attacks.
How To Fix
Minimum fixed version
0:2.6.9-108.module+el8.5.0+738+032c9c02
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to update the 'ruby' package to version 2.6.9-108.module+el8.5.0+738+032c9c02 or later to address these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
These vulnerabilities can lead to arbitrary code execution, command injection, and denial of service attacks.
No specific workaround has been provided for these vulnerabilities.
The vulnerability affects Ruby version 2.6.
There are no known exploits for these vulnerabilities at the moment.
You can find more information about these vulnerabilities on the respective CVE pages: CVE-2020-36327, CVE-2021-31799, CVE-2021-31810, CVE-2021-32066, CVE-2021-41817, CVE-2021-41819.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
