Headline
Red Hat Security Advisory 2023-3291-01
Red Hat Security Advisory 2023-3291-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include HTTP response splitting and denial of service vulnerabilities.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: rh-ruby27-ruby security, bug fix, and enhancement update
Advisory ID: RHSA-2023:3291-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3291
Issue date: 2023-05-24
CVE Names: CVE-2021-33621 CVE-2023-28755 CVE-2023-28756
=====================================================================
- Summary:
An update for rh-ruby27-ruby is now available for Red Hat Software
Collections.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Software Collections for RHEL Workstation(v. 7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for RHEL(v. 7) - noarch, x86_64
- Description:
Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to perform system management tasks.
The following packages have been upgraded to a later upstream version:
rh-ruby27-ruby (2.7.8). (BZ#2149267)
Security Fix(es):
ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
ruby: ReDoS vulnerability in URI (CVE-2023-28755)
ruby: ReDoS vulnerability in Time (CVE-2023-28756)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2149267 - rh-ruby27-ruby: Rebase to the latest Ruby 2.7 release [rhscl-3]
2149706 - CVE-2021-33621 ruby/cgi-gem: HTTP response splitting in CGI
2184059 - CVE-2023-28755 ruby: ReDoS vulnerability in URI
2184061 - CVE-2023-28756 ruby: ReDoS vulnerability in Time
- Package List:
Red Hat Software Collections for RHEL Workstation(v. 7):
Source:
rh-ruby27-ruby-2.7.8-132.el7.src.rpm
noarch:
rh-ruby27-ruby-doc-2.7.8-132.el7.noarch.rpm
rh-ruby27-rubygem-bundler-2.2.24-132.el7.noarch.rpm
rh-ruby27-rubygem-did_you_mean-1.4.0-132.el7.noarch.rpm
rh-ruby27-rubygem-irb-1.2.6-132.el7.noarch.rpm
rh-ruby27-rubygem-minitest-5.13.0-132.el7.noarch.rpm
rh-ruby27-rubygem-net-telnet-0.2.0-132.el7.noarch.rpm
rh-ruby27-rubygem-power_assert-1.1.7-132.el7.noarch.rpm
rh-ruby27-rubygem-rake-13.0.1-132.el7.noarch.rpm
rh-ruby27-rubygem-rdoc-6.2.1.1-132.el7.noarch.rpm
rh-ruby27-rubygem-test-unit-3.3.4-132.el7.noarch.rpm
rh-ruby27-rubygem-xmlrpc-0.3.0-132.el7.noarch.rpm
rh-ruby27-rubygems-3.1.6-132.el7.noarch.rpm
rh-ruby27-rubygems-devel-3.1.6-132.el7.noarch.rpm
ppc64le:
rh-ruby27-ruby-2.7.8-132.el7.ppc64le.rpm
rh-ruby27-ruby-debuginfo-2.7.8-132.el7.ppc64le.rpm
rh-ruby27-ruby-devel-2.7.8-132.el7.ppc64le.rpm
rh-ruby27-ruby-libs-2.7.8-132.el7.ppc64le.rpm
rh-ruby27-rubygem-bigdecimal-2.0.0-132.el7.ppc64le.rpm
rh-ruby27-rubygem-io-console-0.5.6-132.el7.ppc64le.rpm
rh-ruby27-rubygem-json-2.3.0-132.el7.ppc64le.rpm
rh-ruby27-rubygem-openssl-2.1.4-132.el7.ppc64le.rpm
rh-ruby27-rubygem-psych-3.1.0-132.el7.ppc64le.rpm
rh-ruby27-rubygem-racc-1.4.16-132.el7.ppc64le.rpm
s390x:
rh-ruby27-ruby-2.7.8-132.el7.s390x.rpm
rh-ruby27-ruby-debuginfo-2.7.8-132.el7.s390x.rpm
rh-ruby27-ruby-devel-2.7.8-132.el7.s390x.rpm
rh-ruby27-ruby-libs-2.7.8-132.el7.s390x.rpm
rh-ruby27-rubygem-bigdecimal-2.0.0-132.el7.s390x.rpm
rh-ruby27-rubygem-io-console-0.5.6-132.el7.s390x.rpm
rh-ruby27-rubygem-json-2.3.0-132.el7.s390x.rpm
rh-ruby27-rubygem-openssl-2.1.4-132.el7.s390x.rpm
rh-ruby27-rubygem-psych-3.1.0-132.el7.s390x.rpm
rh-ruby27-rubygem-racc-1.4.16-132.el7.s390x.rpm
x86_64:
rh-ruby27-ruby-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-debuginfo-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-devel-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-libs-2.7.8-132.el7.x86_64.rpm
rh-ruby27-rubygem-bigdecimal-2.0.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-io-console-0.5.6-132.el7.x86_64.rpm
rh-ruby27-rubygem-json-2.3.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-openssl-2.1.4-132.el7.x86_64.rpm
rh-ruby27-rubygem-psych-3.1.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-racc-1.4.16-132.el7.x86_64.rpm
Red Hat Software Collections for RHEL(v. 7):
Source:
rh-ruby27-ruby-2.7.8-132.el7.src.rpm
noarch:
rh-ruby27-ruby-doc-2.7.8-132.el7.noarch.rpm
rh-ruby27-rubygem-bundler-2.2.24-132.el7.noarch.rpm
rh-ruby27-rubygem-did_you_mean-1.4.0-132.el7.noarch.rpm
rh-ruby27-rubygem-irb-1.2.6-132.el7.noarch.rpm
rh-ruby27-rubygem-minitest-5.13.0-132.el7.noarch.rpm
rh-ruby27-rubygem-net-telnet-0.2.0-132.el7.noarch.rpm
rh-ruby27-rubygem-power_assert-1.1.7-132.el7.noarch.rpm
rh-ruby27-rubygem-rake-13.0.1-132.el7.noarch.rpm
rh-ruby27-rubygem-rdoc-6.2.1.1-132.el7.noarch.rpm
rh-ruby27-rubygem-test-unit-3.3.4-132.el7.noarch.rpm
rh-ruby27-rubygem-xmlrpc-0.3.0-132.el7.noarch.rpm
rh-ruby27-rubygems-3.1.6-132.el7.noarch.rpm
rh-ruby27-rubygems-devel-3.1.6-132.el7.noarch.rpm
x86_64:
rh-ruby27-ruby-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-debuginfo-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-devel-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-libs-2.7.8-132.el7.x86_64.rpm
rh-ruby27-rubygem-bigdecimal-2.0.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-io-console-0.5.6-132.el7.x86_64.rpm
rh-ruby27-rubygem-json-2.3.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-openssl-2.1.4-132.el7.x86_64.rpm
rh-ruby27-rubygem-psych-3.1.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-racc-1.4.16-132.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-33621
https://access.redhat.com/security/cve/CVE-2023-28755
https://access.redhat.com/security/cve/CVE-2023-28756
https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZG4b0dzjgjWX9erEAQjJrA/+NY2WHGlRLSUT6kfhPeCZILoj7TJO5FFq
0x2CbpMw4Ea2UrJ+42aGpxrhdzf+IEIC07me4VgsEVWtD/P1+QMlgczHq7upbQZv
eLHMIgRKe5Wjq9mP7sQwjwctSxpc8EBmhYyV1X7XyduSm8oaqoog75eps2gMYy4l
kcD50w/wUQb/l8x4hNNaB33EaHUva+wfOqFHaG82KWnn9jt3Db6DqEz9yz3T+70O
Xa/KMgYsfRBN3TK/4VgHf3F2cbut3zpGBqsdtYTL3fSMjHAg+W6/wLd9n/h8Bf7K
bLTYrrcfopFYa/fI1tSTFxvxGh66g3K5rWAiFI0zK3WkveZlkGNa5oaAqf6hDPeU
GAS9oePIHvOkDPVI8L1+CKKxb42IQkeqtdy+Xdgcdvuld7w8XI3Z/GLhe4wzUTlb
pI9RZMWPQRP4nxfZgjjxsV1pqwhhq48Y6AVxTQ5rXsRzMKlK7ucHiCrPCeCKu1U/
DQihClPyedDckWeVGg1+XlLXFo7ENP5ZzQu+0KPOCQnAWpq05Y5I9dsbNZa6RNVj
QdADkyX2LW0u84nuKlfv8TtWeohkeIuMzw0LjQIyArIZVi1+fUg0NbSKw+VKEZAf
XRqaQ2cEBe86IOJdgG8Od/KAxeKZ1nDpQfg2bPsdmGuhdTyIKevAX4vD+B1oyb7S
b3GVrBp6+TY=
=yhcL
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2024-4542-03 - An update for ruby is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Issues addressed include a HTTP response splitting vulnerability.
Red Hat Security Advisory 2024-3838-03 - An update for ruby is now available for Red Hat Enterprise Linux 9. Issues addressed include HTTP response splitting and denial of service vulnerabilities.
Red Hat Security Advisory 2024-3500-03 - An update for the ruby:3.0 module is now available for Red Hat Enterprise Linux 8. Issues addressed include HTTP response splitting and denial of service vulnerabilities.
Red Hat Security Advisory 2024-1576-03 - An update for the ruby:3.1 module is now available for Red Hat Enterprise Linux 9. Issues addressed include HTTP response splitting and denial of service vulnerabilities.
Red Hat Security Advisory 2024-1431-03 - An update for the ruby:3.1 module is now available for Red Hat Enterprise Linux 8. Issues addressed include HTTP response splitting and denial of service vulnerabilities.
Gentoo Linux Security Advisory 202401-27 - Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code. Multiple versions are affected.
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
Ubuntu Security Notice 6181-1 - Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications the generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application. This issue only affected Ubuntu 22.10. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service.
An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33621: A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients. * CVE-2023-28755: A flaw was found in the ...
An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33621: A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients. * CVE-2023-28755: A flaw was found in the ...
An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33621: A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients. * CVE-2023-28755: A flaw was found in the ...
Ubuntu Security Notice 6087-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM.
Ubuntu Security Notice 6087-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM.
Ubuntu Security Notice 6055-2 - USN-6055-1 fixed a vulnerability in Ruby. Unfortunately it introduced a regression. This update reverts the patches applied to CVE-2023-28755 in order to fix the regression pending further investigation. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service.
Ubuntu Security Notice 6055-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue is being addressed only for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
Ubuntu Security Notice 6055-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue is being addressed only for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released eight Industrial Control Systems (ICS) advisories on Tuesday, warning of critical flaws affecting equipment from Delta Electronics and Rockwell Automation. This includes 13 security vulnerabilities in Delta Electronics' InfraSuite Device Master, a real-time device monitoring software. All versions prior to 1.0.5 are
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released eight Industrial Control Systems (ICS) advisories on Tuesday, warning of critical flaws affecting equipment from Delta Electronics and Rockwell Automation. This includes 13 security vulnerabilities in Delta Electronics' InfraSuite Device Master, a real-time device monitoring software. All versions prior to 1.0.5 are
Ubuntu Security Notice 5806-3 - USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 20.04 LTS. Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application.
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.