Moderate: Ruby security, bug fix, and enhancement update
Summary
RLSA-2022:6585: Moderate: ruby security, bug fix, and enhancement update. Affects ruby versions < 0:3.0.4-160.el9_0. Fixed in 0:3.0.4-160.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented, scripting language known for its ability to process text files and perform system management tasks. It is widely used in web development and other applications. The vulnerability affects the Ruby package in Rocky Linux 9.
Vulnerability Detail
The vulnerability (CVE-2022-28738) in Ruby is a double free issue during Regexp compilation. This vulnerability could be exploited by an attacker to execute arbitrary code or cause a denial of service. Another vulnerability (CVE-2022-28739) is a buffer overrun in String-to-Float conversion, which could lead to information disclosure or application crashes. Both vulnerabilities have a CVSS score of 7.7, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:3.0.4-160.el9_0
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Ruby package in Rocky Linux 9 is affected by two moderate-severity vulnerabilities. To mitigate the risks, it is crucial to update the Ruby package to version 3.0.4-160.el9_0 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ruby →
FAQ
Ruby is an interpreted, object-oriented scripting language known for its simplicity and productivity. It is widely used in web development and other applications.
The vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, or disclose sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update the Ruby package to the latest version.
You can refer to the CVE pages for more details: CVE-2022-28738 and CVE-2022-28739.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
