Headline

RHSA-2022:6450: Red Hat Security Advisory: ruby:3.0 security, bug fix, and enhancement update

An update for the ruby:3.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2021-41817: ruby: Regular expression denial of service vulnerability of Date parsing methods
CVE-2021-41819: ruby: Cookie prefix spoofing in CGI::Cookie.parse
CVE-2022-28738: Ruby: Double free in Regexp compilation
CVE-2022-28739: Ruby: Buffer overrun in String-to-Float conversion

2 years ago

Red Hat Security Data

Open in Source

#sql #vulnerability #linux #red_hat #dos #js #ibm #ruby #sap

Synopsis

Moderate: ruby:3.0 security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the ruby:3.0 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109431)

Security Fix(es):

ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
Ruby: Double free in Regexp compilation (CVE-2022-28738)
Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

ruby 3.0: User-installed rubygems plugins are not being loaded [RHEL8] (BZ#2110981)

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
Red Hat Enterprise Linux Server - AUS 8.6 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
Red Hat Enterprise Linux Server - TUS 8.6 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

BZ - 2025104 - CVE-2021-41817 ruby: Regular expression denial of service vulnerability of Date parsing methods
BZ - 2026757 - CVE-2021-41819 ruby: Cookie prefix spoofing in CGI::Cookie.parse
BZ - 2075685 - CVE-2022-28738 Ruby: Double free in Regexp compilation
BZ - 2075687 - CVE-2022-28739 Ruby: Buffer overrun in String-to-Float conversion
BZ - 2109431 - ruby:3.0/ruby: Rebase to the latest Ruby 3.0 release [rhel-8] [rhel-8.6.0.z]
BZ - 2110981 - ruby 3.0: User-installed rubygems plugins are not being loaded [RHEL8] [rhel-8.6.0.z]

CVEs

CVE-2021-41817
CVE-2021-41819
CVE-2022-28738
CVE-2022-28739

Red Hat Enterprise Linux for x86_64 8

SRPM

ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.src.rpm

SHA-256: 836f3fd26e98e50a706392d04aaf285a95e7d49e066f8d855bed0af0cba92cc8

rubygem-abrt-0.4.0-1.module+el8.5.0+11580+845038eb.src.rpm

SHA-256: 2a810d6c61101e660869b97b3684515c4bc5089377b1d7985470e702a8c6da8d

rubygem-mysql2-0.5.3-1.module+el8.5.0+11580+845038eb.src.rpm

SHA-256: ef2fd69d48ff6cac20c5522a4bf04146d15d10574e1a17e8ab1a871ad3fd5c44

rubygem-pg-1.2.3-1.module+el8.5.0+11580+845038eb.src.rpm

SHA-256: 48be4ea7d277288b48acdd57df3c554c22b1af554658906ffc72f94b87328d3f

x86_64

ruby-default-gems-3.0.4-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: eda22ca55b55a00017f057b0626082242edad6a2ac3ab517030415598da3a7c3

ruby-doc-3.0.4-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: 80723ce45e4497c66122e67e26868284c61e4fa3778f385bb72198fc3b626c80

rubygem-abrt-0.4.0-1.module+el8.5.0+11580+845038eb.noarch.rpm

SHA-256: 07da53f8d9687f6e435a60333a05c3cd17309a7562b2d6bd9e413262975c9842

rubygem-abrt-doc-0.4.0-1.module+el8.5.0+11580+845038eb.noarch.rpm

SHA-256: 7dc03ddefcebb68b86f17767b954909d76407069e0b26339a7f7572a0b421b3d

rubygem-bundler-2.2.33-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: 989bdd4727270c3aa1a79262e751dfa0fd2f0f857cbc911e2bfb42f2739ed0fa

rubygem-irb-1.3.5-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: b8c79adae406a2b38d0fdb825100b7c55fac8d71445e5cb517dd0434ce1b5116

rubygem-minitest-5.14.2-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: e0f15e9ce63a53dfd75b0780c58573aff07f0786aeb180b94607a5cfee7d1a5a

rubygem-mysql2-doc-0.5.3-1.module+el8.5.0+11580+845038eb.noarch.rpm

SHA-256: 3ef6e1867e8bcc3fe7b29c81247d947e9c11ebc92f412507fe6264351ec9f337

rubygem-pg-doc-1.2.3-1.module+el8.5.0+11580+845038eb.noarch.rpm

SHA-256: 0c686ef97fb1ffacf8c0dedda20db9c488b6f960afb3ec18cca86d7db0948e90

rubygem-power_assert-1.2.0-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: 4914da7300318813829600bfc14c205d0fe8c89bd319acff6380b60d57654b6d

rubygem-rake-13.0.3-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: bbac5364334d6759a377c9386c91ede82eb836318e296d87fa3e092cceef1315

rubygem-rbs-1.4.0-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: ab75a96d2dcd8afcfa2b3de975106205c1361a8b1fde17b29513786a6b4c3b4c

rubygem-rdoc-6.3.3-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: fba8cf945fdc765e2aa1bef22493733cd5d90970b49f68c729cbd4ae15e71541

rubygem-rexml-3.2.5-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: 5dc6fc2ae74caaa6e4170a3559774729968c4319d8536a107a2e9b710f43f74d

rubygem-rss-0.2.9-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: aad2f3ac42238c2c8204ec79604980b75ac09d262b6e09a21f0a6380c3a013d7

rubygem-test-unit-3.3.7-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: b5842d4ad0b65022c9f64df4128cd71f89e7bd5b81a2149894a13fea00522fcc

rubygem-typeprof-0.15.2-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: 9f41ba55a0fbeff6b25d70b05d93ada6c29ee0a5465cfb89a0613a753cb845c3

rubygems-3.2.33-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: 2afbafc4f4b027599ea1635dab0d641b98fcb094558202baf81d2eda96c18275

rubygems-devel-3.2.33-141.module+el8.6.0+16311+3e5e17e9.noarch.rpm

SHA-256: 9fbd2d0412fd5f3387e24ca1317e777d13525593f8e64534f0acf3458e893c62

ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: a0a34b0a102acceb8143868101f7c9beacdd7794a5b60ed93edd54a2f50c83d8

ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: f7f77154d637a7c4950062b3898cce038f6468dd34a54f961d72b0df22a25732

ruby-debuginfo-3.0.4-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: 722cedab3d9432586b05bd5e55824ee94bd8270857e23b7d52288b0fbfb200ac

ruby-debuginfo-3.0.4-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 391deb832fa6ecd1277fb63f670918dd5b278f3ef78b3b48b595cde0b7dfb0eb

ruby-debugsource-3.0.4-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: 351ef007471ab3688a75b9b503789f8efedc4696f4b7b44dfd3f2c6ce20a4d87

ruby-debugsource-3.0.4-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 443b4a63ac8cca37f2e6e4951e4be79beb2b3b3440af76bd9e4cc6957edfe729

ruby-devel-3.0.4-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: 75b5dd795f50bb9bbf0a757f00e70bcfd58c5f988543638a7bb77050817a2469

ruby-devel-3.0.4-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 66e504ae63b5edd7d832db25ae65f7332ae1a1a6c3b4c989b7d0e86e8c9d48f9

ruby-libs-3.0.4-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: ad9081a8503a0926f7531a5bf63f0ca71e3313cb4d02a16d8f2e6773a0eae3fc

ruby-libs-3.0.4-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: d47ced81feec189590d1afe5e3a1e58072c5937f1ddccbc4637684cd1b2d0dc8

ruby-libs-debuginfo-3.0.4-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: c75cd122ce931dab906ae4fc8b04e298b3632e5bd8e5725cef558bd35471e2e1

ruby-libs-debuginfo-3.0.4-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 8c1b1893e35650e625fadfe9a7e57e7dc233173b5bd2639a4125b79c261713b8

rubygem-bigdecimal-3.0.0-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: 0f11c030a4237644071989b51bc92f231add71de83ee5939c2531b80b22e7d87

rubygem-bigdecimal-3.0.0-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: a68fb56cf5b762b37e31b21713a4a8d71c6e30adcbae9ff33767445d4fff1d05

rubygem-bigdecimal-debuginfo-3.0.0-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: 0f7310459e4c220e478064bc26e8cfe36efc58cbf188864c1d73d54801f8488d

rubygem-bigdecimal-debuginfo-3.0.0-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: c4397ee2977a3defe834a87df6e943aa3b6cf95988c5ba1db1fd38fdd0bc57c8

rubygem-io-console-0.5.7-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: 5acf25b10c5c31b9c21f2e33fe12ec9e753fbcd50ac9901b14b2f63216afa696

rubygem-io-console-0.5.7-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 89dd3e4807e81e633489eec5d78b820f8cdd391299fb1fa4c6bcbb76f864d320

rubygem-io-console-debuginfo-0.5.7-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: 404483095acfbf92760c7ef173244564b029294a2b93c38c47a8563c453f3f14

rubygem-io-console-debuginfo-0.5.7-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 469b373f7ccf2ac8b6cad5223f527ecbfb4731e270ea18cd2794e2256a90c9f6

rubygem-json-2.5.1-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: b9164ef4011e8035ab74e8f0909207a51a7de2587712400dccb7093a05407692

rubygem-json-2.5.1-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 17e976ca8eff47906d29bfbabb5fc6b73e08dc328907f1467c3244d5a988c622

rubygem-json-debuginfo-2.5.1-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: b47763bbd99b5c6a641df9fedb5c82e1890863f35c729c9e0bfebb0264c767ad

rubygem-json-debuginfo-2.5.1-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: ca98729a358fd9a303bc40abe4dc067370f2e85fe359dd4d3c798c959768b19e

rubygem-mysql2-0.5.3-1.module+el8.5.0+11580+845038eb.x86_64.rpm

SHA-256: d1e4240ac676616c3d45fa09625cdaed9c915ede2e34854d1b1840174ceeadac

rubygem-mysql2-debuginfo-0.5.3-1.module+el8.5.0+11580+845038eb.x86_64.rpm

SHA-256: 6db88f307057d73632c7cd4abb8850b54e35a7473e8184650db4eeb6632cf836

rubygem-mysql2-debugsource-0.5.3-1.module+el8.5.0+11580+845038eb.x86_64.rpm

SHA-256: dec8ec95f9fad616bd901a57c1313432bba5e3046f5ebb77faf274dabba20b17

rubygem-pg-1.2.3-1.module+el8.5.0+11580+845038eb.x86_64.rpm

SHA-256: cfe7a1360e5d415608d6ff8b9774323bb8b94d47da9f171aa58538436de110e0

rubygem-pg-debuginfo-1.2.3-1.module+el8.5.0+11580+845038eb.x86_64.rpm

SHA-256: 7f2a5d58c0290cbc35498153462fcfb77a77adaf39097713df41631f35e2aaab

rubygem-pg-debugsource-1.2.3-1.module+el8.5.0+11580+845038eb.x86_64.rpm

SHA-256: 3f08c52070e2d14fa720350a03c0f3aaed34907fb95a1bb9f9553065c013b98f

rubygem-psych-3.3.2-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: 9d4087636634134b43cbdb68adb284b43a2295ba6e248f79f735bd043d3a25c3

rubygem-psych-3.3.2-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 42091570f86b1f151a8c178c98be81061915c6b7f6bf232fda20d530a3624da0

rubygem-psych-debuginfo-3.3.2-141.module+el8.6.0+16311+3e5e17e9.i686.rpm

SHA-256: d83e08e812ead0f45c51a57b16b4575e9ba6e9654993e8555909cfe97b0fbe6b

rubygem-psych-debuginfo-3.3.2-141.module+el8.6.0+16311+3e5e17e9.x86_64.rpm

SHA-256: 329477f77534aa7425268419c6358abb0c13b66f6da026349733822202298884

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6