Important: Security Update for Ruby 2.5
Summary
RLSA-2022:0545: Important: ruby:2.5 security update. Affects ruby versions < 0:2.5.9-107.module+el8.4.0+592+03ff458a. Fixed in 0:2.5.9-107.module+el8.4.0+592+03ff458a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language. It is widely used for processing text files and performing system management tasks. The vulnerability affects the Ruby package version 2.5.
Vulnerability Detail
The vulnerability (CVE-2020-36327) in the rubygem-bundler component allows dependencies of gems with explicit source to be installed from a different source. This could potentially lead to the installation of malicious code or unauthorized access to sensitive information. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:2.5.9-107.module+el8.4.0+592+03ff458a
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible.
Conclusion
It is crucial to update the Ruby package to the fixed version (2.5.9-107.module+el8.4.0+592+03ff458a or later) to mitigate the risk of potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
Ruby is an interpreted, object-oriented scripting language known for its simplicity and flexibility.
The vulnerability allows for the installation of potentially malicious code or unauthorized access to sensitive information.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can update the Ruby package by running the appropriate package manager command for your operating system.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
