Security
Headlines
HeadlinesLatestCVEs

Headline

Red Hat Security Advisory 2023-3291-01

Red Hat Security Advisory 2023-3291-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include HTTP response splitting and denial of service vulnerabilities.

Packet Storm
#vulnerability#red_hat#dos#js#telnet#ruby#ssl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: rh-ruby27-ruby security, bug fix, and enhancement update
Advisory ID: RHSA-2023:3291-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3291
Issue date: 2023-05-24
CVE Names: CVE-2021-33621 CVE-2023-28755 CVE-2023-28756
=====================================================================

  1. Summary:

An update for rh-ruby27-ruby is now available for Red Hat Software
Collections.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Software Collections for RHEL Workstation(v. 7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for RHEL(v. 7) - noarch, x86_64

  1. Description:

Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version:
rh-ruby27-ruby (2.7.8). (BZ#2149267)

Security Fix(es):

  • ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

  • ruby: ReDoS vulnerability in URI (CVE-2023-28755)

  • ruby: ReDoS vulnerability in Time (CVE-2023-28756)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

2149267 - rh-ruby27-ruby: Rebase to the latest Ruby 2.7 release [rhscl-3]
2149706 - CVE-2021-33621 ruby/cgi-gem: HTTP response splitting in CGI
2184059 - CVE-2023-28755 ruby: ReDoS vulnerability in URI
2184061 - CVE-2023-28756 ruby: ReDoS vulnerability in Time

  1. Package List:

Red Hat Software Collections for RHEL Workstation(v. 7):

Source:
rh-ruby27-ruby-2.7.8-132.el7.src.rpm

noarch:
rh-ruby27-ruby-doc-2.7.8-132.el7.noarch.rpm
rh-ruby27-rubygem-bundler-2.2.24-132.el7.noarch.rpm
rh-ruby27-rubygem-did_you_mean-1.4.0-132.el7.noarch.rpm
rh-ruby27-rubygem-irb-1.2.6-132.el7.noarch.rpm
rh-ruby27-rubygem-minitest-5.13.0-132.el7.noarch.rpm
rh-ruby27-rubygem-net-telnet-0.2.0-132.el7.noarch.rpm
rh-ruby27-rubygem-power_assert-1.1.7-132.el7.noarch.rpm
rh-ruby27-rubygem-rake-13.0.1-132.el7.noarch.rpm
rh-ruby27-rubygem-rdoc-6.2.1.1-132.el7.noarch.rpm
rh-ruby27-rubygem-test-unit-3.3.4-132.el7.noarch.rpm
rh-ruby27-rubygem-xmlrpc-0.3.0-132.el7.noarch.rpm
rh-ruby27-rubygems-3.1.6-132.el7.noarch.rpm
rh-ruby27-rubygems-devel-3.1.6-132.el7.noarch.rpm

ppc64le:
rh-ruby27-ruby-2.7.8-132.el7.ppc64le.rpm
rh-ruby27-ruby-debuginfo-2.7.8-132.el7.ppc64le.rpm
rh-ruby27-ruby-devel-2.7.8-132.el7.ppc64le.rpm
rh-ruby27-ruby-libs-2.7.8-132.el7.ppc64le.rpm
rh-ruby27-rubygem-bigdecimal-2.0.0-132.el7.ppc64le.rpm
rh-ruby27-rubygem-io-console-0.5.6-132.el7.ppc64le.rpm
rh-ruby27-rubygem-json-2.3.0-132.el7.ppc64le.rpm
rh-ruby27-rubygem-openssl-2.1.4-132.el7.ppc64le.rpm
rh-ruby27-rubygem-psych-3.1.0-132.el7.ppc64le.rpm
rh-ruby27-rubygem-racc-1.4.16-132.el7.ppc64le.rpm

s390x:
rh-ruby27-ruby-2.7.8-132.el7.s390x.rpm
rh-ruby27-ruby-debuginfo-2.7.8-132.el7.s390x.rpm
rh-ruby27-ruby-devel-2.7.8-132.el7.s390x.rpm
rh-ruby27-ruby-libs-2.7.8-132.el7.s390x.rpm
rh-ruby27-rubygem-bigdecimal-2.0.0-132.el7.s390x.rpm
rh-ruby27-rubygem-io-console-0.5.6-132.el7.s390x.rpm
rh-ruby27-rubygem-json-2.3.0-132.el7.s390x.rpm
rh-ruby27-rubygem-openssl-2.1.4-132.el7.s390x.rpm
rh-ruby27-rubygem-psych-3.1.0-132.el7.s390x.rpm
rh-ruby27-rubygem-racc-1.4.16-132.el7.s390x.rpm

x86_64:
rh-ruby27-ruby-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-debuginfo-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-devel-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-libs-2.7.8-132.el7.x86_64.rpm
rh-ruby27-rubygem-bigdecimal-2.0.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-io-console-0.5.6-132.el7.x86_64.rpm
rh-ruby27-rubygem-json-2.3.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-openssl-2.1.4-132.el7.x86_64.rpm
rh-ruby27-rubygem-psych-3.1.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-racc-1.4.16-132.el7.x86_64.rpm

Red Hat Software Collections for RHEL(v. 7):

Source:
rh-ruby27-ruby-2.7.8-132.el7.src.rpm

noarch:
rh-ruby27-ruby-doc-2.7.8-132.el7.noarch.rpm
rh-ruby27-rubygem-bundler-2.2.24-132.el7.noarch.rpm
rh-ruby27-rubygem-did_you_mean-1.4.0-132.el7.noarch.rpm
rh-ruby27-rubygem-irb-1.2.6-132.el7.noarch.rpm
rh-ruby27-rubygem-minitest-5.13.0-132.el7.noarch.rpm
rh-ruby27-rubygem-net-telnet-0.2.0-132.el7.noarch.rpm
rh-ruby27-rubygem-power_assert-1.1.7-132.el7.noarch.rpm
rh-ruby27-rubygem-rake-13.0.1-132.el7.noarch.rpm
rh-ruby27-rubygem-rdoc-6.2.1.1-132.el7.noarch.rpm
rh-ruby27-rubygem-test-unit-3.3.4-132.el7.noarch.rpm
rh-ruby27-rubygem-xmlrpc-0.3.0-132.el7.noarch.rpm
rh-ruby27-rubygems-3.1.6-132.el7.noarch.rpm
rh-ruby27-rubygems-devel-3.1.6-132.el7.noarch.rpm

x86_64:
rh-ruby27-ruby-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-debuginfo-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-devel-2.7.8-132.el7.x86_64.rpm
rh-ruby27-ruby-libs-2.7.8-132.el7.x86_64.rpm
rh-ruby27-rubygem-bigdecimal-2.0.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-io-console-0.5.6-132.el7.x86_64.rpm
rh-ruby27-rubygem-json-2.3.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-openssl-2.1.4-132.el7.x86_64.rpm
rh-ruby27-rubygem-psych-3.1.0-132.el7.x86_64.rpm
rh-ruby27-rubygem-racc-1.4.16-132.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2021-33621
https://access.redhat.com/security/cve/CVE-2023-28755
https://access.redhat.com/security/cve/CVE-2023-28756
https://access.redhat.com/security/updates/classification/#moderate

  1. Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZG4b0dzjgjWX9erEAQjJrA/+NY2WHGlRLSUT6kfhPeCZILoj7TJO5FFq
0x2CbpMw4Ea2UrJ+42aGpxrhdzf+IEIC07me4VgsEVWtD/P1+QMlgczHq7upbQZv
eLHMIgRKe5Wjq9mP7sQwjwctSxpc8EBmhYyV1X7XyduSm8oaqoog75eps2gMYy4l
kcD50w/wUQb/l8x4hNNaB33EaHUva+wfOqFHaG82KWnn9jt3Db6DqEz9yz3T+70O
Xa/KMgYsfRBN3TK/4VgHf3F2cbut3zpGBqsdtYTL3fSMjHAg+W6/wLd9n/h8Bf7K
bLTYrrcfopFYa/fI1tSTFxvxGh66g3K5rWAiFI0zK3WkveZlkGNa5oaAqf6hDPeU
GAS9oePIHvOkDPVI8L1+CKKxb42IQkeqtdy+Xdgcdvuld7w8XI3Z/GLhe4wzUTlb
pI9RZMWPQRP4nxfZgjjxsV1pqwhhq48Y6AVxTQ5rXsRzMKlK7ucHiCrPCeCKu1U/
DQihClPyedDckWeVGg1+XlLXFo7ENP5ZzQu+0KPOCQnAWpq05Y5I9dsbNZa6RNVj
QdADkyX2LW0u84nuKlfv8TtWeohkeIuMzw0LjQIyArIZVi1+fUg0NbSKw+VKEZAf
XRqaQ2cEBe86IOJdgG8Od/KAxeKZ1nDpQfg2bPsdmGuhdTyIKevAX4vD+B1oyb7S
b3GVrBp6+TY=
=yhcL
-----END PGP SIGNATURE-----

RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Red Hat Security Advisory 2024-4542-03

Red Hat Security Advisory 2024-4542-03 - An update for ruby is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Issues addressed include a HTTP response splitting vulnerability.

Red Hat Security Advisory 2024-3838-03

Red Hat Security Advisory 2024-3838-03 - An update for ruby is now available for Red Hat Enterprise Linux 9. Issues addressed include HTTP response splitting and denial of service vulnerabilities.

Red Hat Security Advisory 2024-3500-03

Red Hat Security Advisory 2024-3500-03 - An update for the ruby:3.0 module is now available for Red Hat Enterprise Linux 8. Issues addressed include HTTP response splitting and denial of service vulnerabilities.

Red Hat Security Advisory 2024-1576-03

Red Hat Security Advisory 2024-1576-03 - An update for the ruby:3.1 module is now available for Red Hat Enterprise Linux 9. Issues addressed include HTTP response splitting and denial of service vulnerabilities.

Red Hat Security Advisory 2024-1431-03

Red Hat Security Advisory 2024-1431-03 - An update for the ruby:3.1 module is now available for Red Hat Enterprise Linux 8. Issues addressed include HTTP response splitting and denial of service vulnerabilities.

Gentoo Linux Security Advisory 202401-27

Gentoo Linux Security Advisory 202401-27 - Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code. Multiple versions are affected.

CVE-2023-36617: CVE-2023-36617: ReDoS vulnerability in URI

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

Ubuntu Security Notice USN-6181-1

Ubuntu Security Notice 6181-1 - Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications the generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application. This issue only affected Ubuntu 22.10. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service.

RHSA-2023:3291: Red Hat Security Advisory: rh-ruby27-ruby security, bug fix, and enhancement update

An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33621: A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients. * CVE-2023-28755: A flaw was found in the ...

RHSA-2023:3291: Red Hat Security Advisory: rh-ruby27-ruby security, bug fix, and enhancement update

An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33621: A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients. * CVE-2023-28755: A flaw was found in the ...

RHSA-2023:3291: Red Hat Security Advisory: rh-ruby27-ruby security, bug fix, and enhancement update

An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33621: A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients. * CVE-2023-28755: A flaw was found in the ...

Ubuntu Security Notice USN-6087-1

Ubuntu Security Notice 6087-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM.

Ubuntu Security Notice USN-6087-1

Ubuntu Security Notice 6087-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM.

Ubuntu Security Notice USN-6055-2

Ubuntu Security Notice 6055-2 - USN-6055-1 fixed a vulnerability in Ruby. Unfortunately it introduced a regression. This update reverts the patches applied to CVE-2023-28755 in order to fix the regression pending further investigation. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service.

Ubuntu Security Notice USN-6055-1

Ubuntu Security Notice 6055-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue is being addressed only for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Ubuntu Security Notice USN-6055-1

Ubuntu Security Notice 6055-1 - It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue is being addressed only for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

GHSA-fg7x-g82r-94qc: Ruby Time component ReDos issue

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

GHSA-hv5j-3h9f-99c2: Ruby URI component ReDoS issue

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

CVE-2023-28756: Ruby 3.2.0 Released

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

CVE-2023-28755: Releases · ruby/uri

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

CISA Alerts on Critical Security Vulnerabilities in Industrial Control Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released eight Industrial Control Systems (ICS) advisories on Tuesday, warning of critical flaws affecting equipment from Delta Electronics and Rockwell Automation. This includes 13 security vulnerabilities in Delta Electronics' InfraSuite Device Master, a real-time device monitoring software. All versions prior to 1.0.5 are

CISA Alerts on Critical Security Vulnerabilities in Industrial Control Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released eight Industrial Control Systems (ICS) advisories on Tuesday, warning of critical flaws affecting equipment from Delta Electronics and Rockwell Automation. This includes 13 security vulnerabilities in Delta Electronics' InfraSuite Device Master, a real-time device monitoring software. All versions prior to 1.0.5 are

Ubuntu Security Notice USN-5806-3

Ubuntu Security Notice 5806-3 - USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 20.04 LTS. Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application.

CVE-2021-33621: CVE-2021-33621: HTTP response splitting in CGI

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Packet Storm: Latest News

Ivanti EPM Agent Portal Command Execution