Headline
Red Hat Security Advisory 2022-6447-01
Red Hat Security Advisory 2022-6447-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include denial of service and spoofing vulnerabilities.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: ruby:2.7 security, bug fix, and enhancement update
Advisory ID: RHSA-2022:6447-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6447
Issue date: 2022-09-13
CVE Names: CVE-2021-41817 CVE-2021-41819 CVE-2022-28739
=====================================================================
- Summary:
An update for the ruby:2.7 module is now available for Red Hat Enterprise
Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
- Description:
Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to perform system management tasks.
The following packages have been upgraded to a later upstream version: ruby
(2.7.6). (BZ#2109424)
Security Fix(es):
ruby: Regular expression denial of service vulnerability of Date parsing
methods (CVE-2021-41817)ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2025104 - CVE-2021-41817 ruby: Regular expression denial of service vulnerability of Date parsing methods
2026757 - CVE-2021-41819 ruby: Cookie prefix spoofing in CGI::Cookie.parse
2075687 - CVE-2022-28739 Ruby: Buffer overrun in String-to-Float conversion
2109424 - ruby:2.7/ruby: Rebase to the latest Ruby 2.7 release [rhel-8] [rhel-8.6.0.z]
- Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.src.rpm
rubygem-abrt-0.4.0-1.module+el8.3.0+7192+4e3a532a.src.rpm
rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.src.rpm
rubygem-mongo-2.11.3-1.module+el8.3.0+7192+4e3a532a.src.rpm
rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.src.rpm
rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.src.rpm
aarch64:
ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
ruby-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
ruby-debugsource-2.7.6-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
ruby-devel-2.7.6-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
ruby-libs-2.7.6-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
ruby-libs-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-bigdecimal-2.0.0-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-bigdecimal-debuginfo-2.0.0-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-io-console-0.5.6-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-io-console-debuginfo-0.5.6-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-json-2.3.0-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-json-debuginfo-2.3.0-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-openssl-2.1.3-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-openssl-debuginfo-2.1.3-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm
rubygem-psych-3.1.0-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
rubygem-psych-debuginfo-3.1.0-138.module+el8.6.0+16148+54b2ba8f.aarch64.rpm
noarch:
ruby-default-gems-2.7.6-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
ruby-doc-2.7.6-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-abrt-0.4.0-1.module+el8.3.0+7192+4e3a532a.noarch.rpm
rubygem-abrt-doc-0.4.0-1.module+el8.3.0+7192+4e3a532a.noarch.rpm
rubygem-bson-doc-4.8.1-1.module+el8.3.0+7192+4e3a532a.noarch.rpm
rubygem-bundler-2.2.24-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-irb-1.2.6-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-minitest-5.13.0-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-mongo-2.11.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm
rubygem-mongo-doc-2.11.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm
rubygem-mysql2-doc-0.5.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm
rubygem-net-telnet-0.2.0-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-pg-doc-1.2.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm
rubygem-power_assert-1.1.7-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-rake-13.0.1-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-rdoc-6.2.1.1-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-test-unit-3.3.4-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygem-xmlrpc-0.3.0-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygems-3.1.6-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
rubygems-devel-3.1.6-138.module+el8.6.0+16148+54b2ba8f.noarch.rpm
ppc64le:
ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
ruby-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
ruby-debugsource-2.7.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
ruby-devel-2.7.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
ruby-libs-2.7.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
ruby-libs-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-bigdecimal-2.0.0-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-bigdecimal-debuginfo-2.0.0-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-io-console-0.5.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-io-console-debuginfo-0.5.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-json-2.3.0-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-json-debuginfo-2.3.0-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-openssl-2.1.3-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-openssl-debuginfo-2.1.3-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm
rubygem-psych-3.1.0-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
rubygem-psych-debuginfo-3.1.0-138.module+el8.6.0+16148+54b2ba8f.ppc64le.rpm
s390x:
ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
ruby-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
ruby-debugsource-2.7.6-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
ruby-devel-2.7.6-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
ruby-libs-2.7.6-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
ruby-libs-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-bigdecimal-2.0.0-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-bigdecimal-debuginfo-2.0.0-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-io-console-0.5.6-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-io-console-debuginfo-0.5.6-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-json-2.3.0-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-json-debuginfo-2.3.0-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-openssl-2.1.3-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-openssl-debuginfo-2.1.3-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm
rubygem-psych-3.1.0-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
rubygem-psych-debuginfo-3.1.0-138.module+el8.6.0+16148+54b2ba8f.s390x.rpm
x86_64:
ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
ruby-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
ruby-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
ruby-debugsource-2.7.6-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
ruby-debugsource-2.7.6-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
ruby-devel-2.7.6-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
ruby-devel-2.7.6-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
ruby-libs-2.7.6-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
ruby-libs-2.7.6-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
ruby-libs-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
ruby-libs-debuginfo-2.7.6-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-bigdecimal-2.0.0-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-bigdecimal-2.0.0-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-bigdecimal-debuginfo-2.0.0-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-bigdecimal-debuginfo-2.0.0-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-io-console-0.5.6-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-io-console-0.5.6-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-io-console-debuginfo-0.5.6-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-io-console-debuginfo-0.5.6-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-json-2.3.0-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-json-2.3.0-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-json-debuginfo-2.3.0-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-json-debuginfo-2.3.0-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-openssl-2.1.3-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-openssl-2.1.3-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-openssl-debuginfo-2.1.3-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-openssl-debuginfo-2.1.3-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm
rubygem-psych-3.1.0-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-psych-3.1.0-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
rubygem-psych-debuginfo-3.1.0-138.module+el8.6.0+16148+54b2ba8f.i686.rpm
rubygem-psych-debuginfo-3.1.0-138.module+el8.6.0+16148+54b2ba8f.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-41817
https://access.redhat.com/security/cve/CVE-2021-41819
https://access.redhat.com/security/cve/CVE-2022-28739
https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYyCB8tzjgjWX9erEAQgejg/+OH6Jsb1IZAFisrfV/6nIZOkFqhSKpzNf
4VhuC22aesYUEWvSip2jHbFeGVkuI+iqieKPGLr6qHxZ4m8gt5EC8Ti8L6RbJ6rx
W0/JZBalDZDLbsZJrbAH3EoP5WOQ1DYY+FTXaQNX4Yf2VIhTTFFtBXrYumtikkcW
K8u1qT6v3rhdysSwJc+SZi0X2AVQrTRrRXjN4ozsypJvyAkOQRYB+v79YSNVK80q
KF/4U76ohYBx5pbzHW+Vqf8ZMBaGuseXFbcgcqlWUC4n8pKNo06pcof5+nkMYM2Z
tPieoq7AYs9f0zeVi39kkqhyXDPCZhCxcCaBepSAFAEUil6Pib7yWA+AA/FsITC6
Zvyn9ALA25XrUeeUAH8VngWWpJH6vcYxJe2AzkPXYoGEdgNhVgpnmdLWVkd80VSG
ASEnPstIqYUGNR4Y1rTTy6DuvlFBlLfbwntfq1FtlXiScpvpQ8sJ+cquE4UaxWc2
ifggdPHVHILtNFom3hDNx1l89v2bOLhS6/1DgqRKUq/J1zvHx61rCqxZ1pwh3U23
rX2UPZ7oFlZCN2g884wLUJFPbJEs8di/0MTm6bdka27O1SP0h6d9vhZ4O69L8/BP
GdtDZBe0TchUf+Zr0mAf7k0Mb66XH9/8oru+iEMq0tky97EVOpmbzbrYiOYdrJ4Y
kP56IuEnZFk=
=Mwlx
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Gentoo Linux Security Advisory 202401-27 - Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code. Multiple versions are affected.
Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1. A remote user may be able to write arbitrary files.
Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.
A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted image may lead to arbitrary code execution.
Red Hat Security Advisory 2022-6856-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include buffer overflow, denial of service, and spoofing vulnerabilities.
An update for rh-ruby30-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41816: ruby: buffer overflow in CGI.escape_html * CVE-2021-41817: ruby: Regular expression denial of service vulnerability of Date parsing methods * CVE-2021-41819: ruby: Cookie prefix spoofing in CGI::Cookie.parse * CVE-2022-28738: Ruby: Double free in Regexp compilation * CVE-2022-28739: Ruby: Buffer overrun in String-to-Float conversion
An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41816: ruby: buffer overflow in CGI.escape_html * CVE-2021-41817: ruby: Regular expression denial of service vulnerability of Date parsing methods * CVE-2021-41819: ruby: Cookie prefix spoofing in CGI::Cookie.parse * CVE-2022-28739: Ruby: Buffer overrun in String-to-Float conversion
Red Hat Security Advisory 2022-6585-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include a double free vulnerability.
An update for ruby is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-28738: Ruby: Double free in Regexp compilation * CVE-2022-28739: Ruby: Buffer overrun in String-to-Float conversion
Red Hat Security Advisory 2022-6450-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include denial of service, double free, and spoofing vulnerabilities.
An update for the ruby:3.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41817: ruby: Regular expression denial of service vulnerability of Date parsing methods * CVE-2021-41819: ruby: Cookie prefix spoofing in CGI::Cookie.parse * CVE-2022-28738: Ruby: Double free in Regexp compilation * CVE-2022-28739: Ruby: Buffer overrun in String-to-Float conversion
An update for the ruby:2.7 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41817: ruby: Regular expression denial of service vulnerability of Date parsing methods * CVE-2021-41819: ruby: Cookie prefix spoofing in CGI::Cookie.parse * CVE-2022-28739: Ruby: Buffer overrun in String-to-Float conversion
An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41817: ruby: Regular expression denial of service vulnerability of Date parsing methods * CVE-2021-41819: ruby: Cookie prefix spoofing in CGI::Cookie.parse
An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41817: ruby: Regular expression denial of service vulnerability of Date parsing methods * CVE-2021-41819: ruby: Cookie prefix spoofing in CGI::Cookie.parse
Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.
Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.
Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.
Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.
Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.
An update for the ruby:2.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-28739: Ruby: Buffer overrun in String-to-Float conversion
Ubuntu Security Notice 5462-2 - USN-5462-1 fixed several vulnerabilities in Ruby. This update provides the corresponding CVE-2022-28739 update for ruby2.3 on Ubuntu 16.04 ESM. It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information.
Ubuntu Security Notice 5462-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information.
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.