Headline

RHSA-2022:0582: Red Hat Security Advisory: ruby:2.6 security update

An update for the ruby:2.6 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2019-15845: ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?
CVE-2019-16201: ruby: Regular expression denial of service vulnerability of WEBrick’s Digest authentication
CVE-2019-16254: ruby: HTTP response splitting in WEBrick
CVE-2019-16255: ruby: Code injection via command argument of Shell#test / Shell#[]
CVE-2020-10663: rubygem-json: Unsafe object creation vulnerability in JSON
CVE-2020-10933: ruby: BasicSocket#read_nonblock method leads to information disclosure
CVE-2020-25613: ruby: Potential HTTP request smuggling in WEBrick
CVE-2020-36327: rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source
CVE-2021-28965: ruby: XML round-trip vulnerability in REXML
CVE-2021-31799: rubygem-rdoc: Command injection vulnerability in RDoc
CVE-2021-31810: ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host
CVE-2021-32066: ruby: StartTLS stripping vulnerability in Net::IMAP
CVE-2021-41817: ruby: Regular expression denial of service vulnerability of Date parsing methods
CVE-2021-41819: ruby: Cookie prefix spoofing in CGI::Cookie.parse

2 years ago

Red Hat Security Data

Open in Source

#sql #vulnerability #web #linux #red_hat #dos #js

Synopsis

Important: ruby:2.6 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the ruby:2.6 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)
ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)
ruby: Regular expression denial of service vulnerability of WEBrick’s Digest authentication (CVE-2019-16201)
ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)
rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)
ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)
ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)
ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)
rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)
ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)
ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)
ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
Red Hat Enterprise Linux Server - AUS 8.2 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
Red Hat Enterprise Linux Server - TUS 8.2 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.2 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.2 x86_64

Fixes

BZ - 1773728 - CVE-2019-16201 ruby: Regular expression denial of service vulnerability of WEBrick’s Digest authentication
BZ - 1789407 - CVE-2019-15845 ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?
BZ - 1789556 - CVE-2019-16254 ruby: HTTP response splitting in WEBrick
BZ - 1793683 - CVE-2019-16255 ruby: Code injection via command argument of Shell#test / Shell#[]
BZ - 1827500 - CVE-2020-10663 rubygem-json: Unsafe object creation vulnerability in JSON
BZ - 1833291 - CVE-2020-10933 ruby: BasicSocket#read_nonblock method leads to information disclosure
BZ - 1883623 - CVE-2020-25613 ruby: Potential HTTP request smuggling in WEBrick
BZ - 1947526 - CVE-2021-28965 ruby: XML round-trip vulnerability in REXML
BZ - 1958999 - CVE-2020-36327 rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source
BZ - 1980126 - CVE-2021-31810 ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host
BZ - 1980128 - CVE-2021-32066 ruby: StartTLS stripping vulnerability in Net::IMAP
BZ - 1980132 - CVE-2021-31799 rubygem-rdoc: Command injection vulnerability in RDoc
BZ - 2025104 - CVE-2021-41817 ruby: Regular expression denial of service vulnerability of Date parsing methods
BZ - 2026757 - CVE-2021-41819 ruby: Cookie prefix spoofing in CGI::Cookie.parse

CVEs

CVE-2019-15845
CVE-2019-16201
CVE-2019-16254
CVE-2019-16255
CVE-2020-10663
CVE-2020-10933
CVE-2020-25613
CVE-2020-36327
CVE-2021-28965
CVE-2021-31799
CVE-2021-31810
CVE-2021-32066
CVE-2021-41817
CVE-2021-41819

References

https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/articles/6206172

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2

SRPM

ruby-2.6.9-107.module+el8.2.0+14086+86d863af.src.rpm

SHA-256: 7904df99a95692b8717743ba37fdd99782f766d62fb05cc27bc367c2254bc9bc

rubygem-abrt-0.3.0-4.module+el8.1.0+3653+beb38eb0.src.rpm

SHA-256: 3fcbe3bc8c60face0300cf3ed45e4ec21fd6df3071c2ea36d359c3093ebd0dbb

rubygem-bson-4.5.0-1.module+el8.1.0+3653+beb38eb0.src.rpm

SHA-256: 7831b53ebe6e4ce287da95165901c4b0a2459887bb7fd18149df1645576f4434

rubygem-mongo-2.8.0-1.module+el8.1.0+3653+beb38eb0.src.rpm

SHA-256: f3c8d96ecb5e6b2b18e29bdb3cc7be40d9c531556356344b6909c8f325356007

rubygem-mysql2-0.5.2-1.module+el8.1.0+3653+beb38eb0.src.rpm

SHA-256: 0bba0d381e8e6753a2e60a8c436a9d58dc4c14e6c30a40db8d63e704c69eca58

rubygem-pg-1.1.4-1.module+el8.1.0+3653+beb38eb0.src.rpm

SHA-256: 9d91431e97fa54b274f2a9c423e9b1c1ef8a5a879e91405e705017a6d4a07ece

x86_64

ruby-doc-2.6.9-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 4c0666f17d9aed35d930998e53cf53612f0eee08401323b4af847e49bd6f4c63

rubygem-abrt-0.3.0-4.module+el8.1.0+3653+beb38eb0.noarch.rpm

SHA-256: 837f466df4d8b85f0804081129db4b2f0973a18aa27ccab947c8924b286968ea

rubygem-abrt-doc-0.3.0-4.module+el8.1.0+3653+beb38eb0.noarch.rpm

SHA-256: 2b1eb7462d48e372d5c9d984a784cfd4a5891d4adb5bb5b3e30d5f58348c7dce

rubygem-bson-doc-4.5.0-1.module+el8.1.0+3653+beb38eb0.noarch.rpm

SHA-256: be62774bd0962078492e843559076e2b9ffa9f1937a148f8e9eb54611a9d1a09

rubygem-bundler-1.17.2-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 74a22ab49dfcfd91266ce86d3489a9266ad469eb40ca94087161d3b89e338256

rubygem-did_you_mean-1.3.0-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 2b9ccf3e1b28a94576610f017e91b3c9070b6ede16fdab77936af3630f516124

rubygem-irb-1.0.0-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: fbd7c15cd749411197465fa08f1294963c644a7d1768151feef59d167f6f3d24

rubygem-minitest-5.11.3-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 9dea219cbd54e8d9ebaef9896e3bb90480bb528071fe3d5ec7e99ac89424f244

rubygem-mongo-2.8.0-1.module+el8.1.0+3653+beb38eb0.noarch.rpm

SHA-256: 269f82b5979443f6755badefa110bdd33bf5badcfd4d549af37b6b230ca67b0a

rubygem-mongo-doc-2.8.0-1.module+el8.1.0+3653+beb38eb0.noarch.rpm

SHA-256: cfb71d26294990d14c5e4225e3be115c79cf48ad1bde0a66ad2ea7641683c99d

rubygem-mysql2-doc-0.5.2-1.module+el8.1.0+3653+beb38eb0.noarch.rpm

SHA-256: 54ee4063ef55c6534633001cbfdd487989ccc7587b3261b37d4e9e5e48eee6be

rubygem-net-telnet-0.2.0-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 79071f87fd2fccd94487c46e7984827705f8e58a5f10204edb0d8603bb2b4e8d

rubygem-pg-doc-1.1.4-1.module+el8.1.0+3653+beb38eb0.noarch.rpm

SHA-256: 2c9e5fad1def2b234b8050271e2dc6e082a71b5ec85299adf09453f078007f18

rubygem-power_assert-1.1.3-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: b25e8e1ff930f43fba050348f090928b045fdc57c5183a14dd47b6060ca21d85

rubygem-rake-12.3.3-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: d5af6d9bcf6128f5cca63fff6fea9a1df4849a51388c99117fe1a56a9e9e0c90

rubygem-rdoc-6.1.2.1-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 9eade3ab307d7fd83afb7109b4b2a8fbed1fc569133e7de71021eff89822fd96

rubygem-test-unit-3.2.9-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 6e7e9f2a916ec90668eb7ee3d79d0033bf469dc451f5f4b873d417184893799e

rubygem-xmlrpc-0.3.0-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 8c685c7df220adfa64a8943104d4180e6dd1f20773bf5148e624ec0d5907e58f

rubygems-3.0.3.1-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 36375c270d663c77cb75774ddf1e7f8b31bb0280ccb7b5c88f05921407557a19

rubygems-devel-3.0.3.1-107.module+el8.2.0+14086+86d863af.noarch.rpm

SHA-256: 915f597adf43040eef5684eb9704c479bc9a4d22bcc059a701d485a65383d42e

ruby-2.6.9-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: 59b6c6535c6f6bfbf1151d0d9c954a887eb3a247804f8cc056563ef3e08947c6

ruby-2.6.9-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: ef103fdae3f67b224e6bfc49ed28ae8c0556c7ec64e448b4b505f90e0db6bf3e

ruby-debuginfo-2.6.9-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: 2e0fdaf0a10c517b97fed9bcbb9d29eccd42b347a91c18edf49b1c2502557e23

ruby-debuginfo-2.6.9-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: fca28c72a26b545fd61e7111a147f6f646df2ae87e42e4a668762e17ddae6f2b

ruby-debugsource-2.6.9-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: 626682bce5443aa1f83d869b7ba4d476972941fe68ee86a522ae6f58097253d2

ruby-debugsource-2.6.9-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 80aae2a78c9789ecfb68cddb87253494cf388c91c959d6b7d9fb5cee0782fcc6

ruby-devel-2.6.9-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: 6868306550832cff461206138d60049e4f3fc95291aa242408e0d0ad7e0fcb70

ruby-devel-2.6.9-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 4038a46b4c6f4d4c587059f00687fa66d1f0945da40fc83da9b19bde21cbad90

ruby-libs-2.6.9-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: f045846dd856f5f6cdd2863d4b810f4b6ba97bcd64d75d5d8505c16ac433ff26

ruby-libs-2.6.9-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: d21f0cfec4c6bfd21a1543ae74e3a800f0bcf40cf56f343afe94c0e59309a9e2

ruby-libs-debuginfo-2.6.9-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: f061b7e96a5516f0e80f1d40e24713f4e8fa920df0019b7fc4e74c74670a1ac9

ruby-libs-debuginfo-2.6.9-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: c4ba9d149b441129df9ae93040613ecaaf3e24f62977b6f2f7e7c0e73a2423b0

rubygem-bigdecimal-1.4.1-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: efd579c5fb039626434b6ae9b94ddf16dc06937a146e5b545bb9969fb0996c13

rubygem-bigdecimal-1.4.1-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: eb75b8776334f7ba9e08568303417aec7ac30c22954d4122d7cbaa692bc0fa40

rubygem-bigdecimal-debuginfo-1.4.1-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: bbc26c05d3a1d221cbef732355dff8d8dc2a3bf353b65b7bbb65378a0bd3b372

rubygem-bigdecimal-debuginfo-1.4.1-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 6a5d665366a3fd7daee1218ac67b38f265e04c0420913f97b18bc3b6d1017c93

rubygem-bson-4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: ea0636c15a386f5bf5784c8bf806965170c5e08cc443925c60f64fc2c62c0732

rubygem-bson-debuginfo-4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: 902fc597202c00887c7fe1c034c3716ba939c37435166ccbdf4931e1dd9f0f15

rubygem-bson-debugsource-4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: 25220b3dc705e37e831a7c03d8d6087671c311d127217792413e23767c86437d

rubygem-io-console-0.4.7-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: cbe9a3c345642d548494c606e67eaaf8aac4db7c0354d632d4a6fac0729aee98

rubygem-io-console-0.4.7-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 02f30613164e053d2d0bc210d0105debc593e3473bdb3f11334c2751ae9d04dc

rubygem-io-console-debuginfo-0.4.7-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: 416d700c2beca9430291d41f409a02d5ee70a62c3871c0f60801510750834f54

rubygem-io-console-debuginfo-0.4.7-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 70eb833c2d300fef358d2261ca3cadd300b4c0cdf7eace6a727ecab2f912a77c

rubygem-json-2.1.0-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: d40d2b8c10cea31ff502907c1979a90fe479cec0e9780c18e30e412a69b991dc

rubygem-json-2.1.0-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 91f4f132852e465b1f8237dcdd54a58c7bcd9d1dd753b40f7463ae44cec169fd

rubygem-json-debuginfo-2.1.0-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: 2f40145dcccf840b8650c90848da2c03307c7f98f012c76fd4e8430df7598f14

rubygem-json-debuginfo-2.1.0-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 480e959a9af171d11645c7ddd1bebe577010222bfc060af3af3220b0054aa667

rubygem-mysql2-0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: 82bb6f741c2158503d39ba327a9a18d7c30e845473e7274bdd2056bdca3d10bc

rubygem-mysql2-debuginfo-0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: 0b1ea3f6323b35f2c5c523ac195e7a825546d870afa7f66376173ea94d65ee9a

rubygem-mysql2-debugsource-0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: bde361f51c07a57b238fb376822c67387ccfee85e42d6ae3a9e99cdd9f9c423d

rubygem-openssl-2.1.2-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: 9f31fd0d2d23eaa49ece1454797b44c55f493e843f9d5d94a02f92b7a4531240

rubygem-openssl-2.1.2-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: d4079afc25d9534c29787426836ee6645f1bf5b9351d720220772a4de3ecc64b

rubygem-openssl-debuginfo-2.1.2-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: b0e64f93dc14e4514cbe4f505cc50d6d2077cfa051744b3c8fe01de2116dbafa

rubygem-openssl-debuginfo-2.1.2-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 2570902a5bd105d8341e10b2800a9dcb50da4fbb3c0917b29a9cdca00a2b7055

rubygem-pg-1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: a11746a72b4878898766e4710e21227b38832772d587016f4ed7ecef8c05af5b

rubygem-pg-debuginfo-1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: 9a5f97dffa5e296092daa81504369809b8f2b8e03f04521af6d2c103644d00ca

rubygem-pg-debugsource-1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm

SHA-256: b82fc0d53798d8d3e62c11effc58985f84ad819e63d101aa99ddf924d9fa55c1

rubygem-psych-3.1.0-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: f46c442408318ea777602b2e074d1cfde4f3ca44455c3988b2a8e00c6d7b59a4

rubygem-psych-3.1.0-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: d788768e7dbaf1e0ece5d681096b460acc91396a8c8465382968a145c6cd2ee7

rubygem-psych-debuginfo-3.1.0-107.module+el8.2.0+14086+86d863af.i686.rpm

SHA-256: 63528f16541951b13994ddb6b2f2bde1e3837fad0673cb229b7be7bb85e6aefc

rubygem-psych-debuginfo-3.1.0-107.module+el8.2.0+14086+86d863af.x86_64.rpm

SHA-256: 7dd427da86c65edfbd89df153401e80be5f47934dcdda41748b2aa9d488b9490

Red Hat Enterprise Linux Server - AUS 8.2