Moderate: ruby:3.0 security update

2024-05-3000:00:00

errata.almalinux.org

ruby language

security fix

http response splitting

redos vulnerability

rce vulnerability

buffer overread vulnerability

memory address read vulnerability

cve-2021-33621

cve-2023-28755

cve-2023-28756

cve-2024-27281

cve-2024-27280

cve-2024-27282

unix operating system

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

Low

EPSS

0.005

Percentile

77.3%

JSON

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
ruby: ReDoS vulnerability in URI (CVE-2023-28755)
ruby: ReDoS vulnerability in Time (CVE-2023-28756)
ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8i686ruby< 3.0.7-143.module_el8.10.0+3852+ce828b19ruby-3.0.7-143.module_el8.10.0+3852+ce828b19.i686.rpm
almalinux8noarchrubygem-minitest< 5.14.2-143.module_el8.10.0+3852+ce828b19rubygem-minitest-5.14.2-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux8noarchrubygem-rss< 0.2.9-143.module_el8.10.0+3852+ce828b19rubygem-rss-0.2.9-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux8noarchrubygem-rbs< 1.4.0-143.module_el8.10.0+3852+ce828b19rubygem-rbs-1.4.0-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux8noarchrubygems-devel< 3.2.33-143.module_el8.10.0+3852+ce828b19rubygems-devel-3.2.33-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux8noarchrubygem-power_assert< 1.2.1-143.module_el8.10.0+3852+ce828b19rubygem-power_assert-1.2.1-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux8noarchrubygem-typeprof< 0.15.2-143.module_el8.10.0+3852+ce828b19rubygem-typeprof-0.15.2-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux8noarchrubygem-rake< 13.0.3-143.module_el8.10.0+3852+ce828b19rubygem-rake-13.0.3-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux8noarchrubygem-bundler< 2.2.33-143.module_el8.10.0+3852+ce828b19rubygem-bundler-2.2.33-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux8noarchrubygem-rdoc< 6.3.4.1-143.module_el8.10.0+3852+ce828b19rubygem-rdoc-6.3.4.1-143.module_el8.10.0+3852+ce828b19.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	i686	ruby	< 3.0.7-143.module_el8.10.0+3852+ce828b19	ruby-3.0.7-143.module_el8.10.0+3852+ce828b19.i686.rpm
almalinux	8	noarch	rubygem-minitest	< 5.14.2-143.module_el8.10.0+3852+ce828b19	rubygem-minitest-5.14.2-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux	8	noarch	rubygem-rss	< 0.2.9-143.module_el8.10.0+3852+ce828b19	rubygem-rss-0.2.9-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux	8	noarch	rubygem-rbs	< 1.4.0-143.module_el8.10.0+3852+ce828b19	rubygem-rbs-1.4.0-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux	8	noarch	rubygems-devel	< 3.2.33-143.module_el8.10.0+3852+ce828b19	rubygems-devel-3.2.33-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux	8	noarch	rubygem-power_assert	< 1.2.1-143.module_el8.10.0+3852+ce828b19	rubygem-power_assert-1.2.1-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux	8	noarch	rubygem-typeprof	< 0.15.2-143.module_el8.10.0+3852+ce828b19	rubygem-typeprof-0.15.2-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux	8	noarch	rubygem-rake	< 13.0.3-143.module_el8.10.0+3852+ce828b19	rubygem-rake-13.0.3-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux	8	noarch	rubygem-bundler	< 2.2.33-143.module_el8.10.0+3852+ce828b19	rubygem-bundler-2.2.33-143.module_el8.10.0+3852+ce828b19.noarch.rpm
almalinux	8	noarch	rubygem-rdoc	< 6.3.4.1-143.module_el8.10.0+3852+ce828b19	rubygem-rdoc-6.3.4.1-143.module_el8.10.0+3852+ce828b19.noarch.rpm