Moderate: ruby security update

2024-07-1100:00:00

errata.almalinux.org

ruby

security fix

buffer overread

rce vulnerability

dos parsing

cve-2023-28755

cve-2024-27280

cve-2024-27281

cve-2024-27282

cve-2024-35176

object-oriented

scripting language

text files

system management.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.004

Percentile

72.3%

JSON

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

rubygem-uri: ReDoS vulnerability - upstream’s incomplete fix for CVE-2023-28755 (CVE-2023-36617)
ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)
REXML: DoS parsing an XML with many <s in an attribute value (CVE-2024-35176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8i686rubygem-bigdecimal< 1.3.4-112.module_el8.10.0+3871+342e2c2frubygem-bigdecimal-1.3.4-112.module_el8.10.0+3871+342e2c2f.i686.rpm
almalinux8noarchrubygem-net-telnet< 0.1.1-112.module_el8.10.0+3871+342e2c2frubygem-net-telnet-0.1.1-112.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux8noarchrubygem-did_you_mean< 1.2.0-112.module_el8.10.0+3871+342e2c2frubygem-did_you_mean-1.2.0-112.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux8noarchrubygem-bundler< 1.16.1-4.module_el8.10.0+3871+342e2c2frubygem-bundler-1.16.1-4.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux8noarchrubygem-power_assert< 1.1.1-112.module_el8.10.0+3871+342e2c2frubygem-power_assert-1.1.1-112.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux8noarchrubygem-abrt-doc< 0.3.0-4.module_el8.10.0+3871+342e2c2frubygem-abrt-doc-0.3.0-4.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux8noarchrubygem-test-unit< 3.2.7-112.module_el8.10.0+3871+342e2c2frubygem-test-unit-3.2.7-112.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux8i686ruby-libs< 2.5.9-112.module_el8.10.0+3871+342e2c2fruby-libs-2.5.9-112.module_el8.10.0+3871+342e2c2f.i686.rpm
almalinux8noarchrubygem-bundler-doc< 1.16.1-4.module_el8.10.0+3871+342e2c2frubygem-bundler-doc-1.16.1-4.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux8noarchrubygem-bson-doc< 4.3.0-2.module_el8.5.0+2625+ec418553Packages/rubygem-bson-doc-4.3.0-2.module_el8.5.0+2625+ec418553.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	i686	rubygem-bigdecimal	< 1.3.4-112.module_el8.10.0+3871+342e2c2f	rubygem-bigdecimal-1.3.4-112.module_el8.10.0+3871+342e2c2f.i686.rpm
almalinux	8	noarch	rubygem-net-telnet	< 0.1.1-112.module_el8.10.0+3871+342e2c2f	rubygem-net-telnet-0.1.1-112.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux	8	noarch	rubygem-did_you_mean	< 1.2.0-112.module_el8.10.0+3871+342e2c2f	rubygem-did_you_mean-1.2.0-112.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux	8	noarch	rubygem-bundler	< 1.16.1-4.module_el8.10.0+3871+342e2c2f	rubygem-bundler-1.16.1-4.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux	8	noarch	rubygem-power_assert	< 1.1.1-112.module_el8.10.0+3871+342e2c2f	rubygem-power_assert-1.1.1-112.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux	8	noarch	rubygem-abrt-doc	< 0.3.0-4.module_el8.10.0+3871+342e2c2f	rubygem-abrt-doc-0.3.0-4.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux	8	noarch	rubygem-test-unit	< 3.2.7-112.module_el8.10.0+3871+342e2c2f	rubygem-test-unit-3.2.7-112.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux	8	i686	ruby-libs	< 2.5.9-112.module_el8.10.0+3871+342e2c2f	ruby-libs-2.5.9-112.module_el8.10.0+3871+342e2c2f.i686.rpm
almalinux	8	noarch	rubygem-bundler-doc	< 1.16.1-4.module_el8.10.0+3871+342e2c2f	rubygem-bundler-doc-1.16.1-4.module_el8.10.0+3871+342e2c2f.noarch.rpm
almalinux	8	noarch	rubygem-bson-doc	< 4.3.0-2.module_el8.5.0+2625+ec418553	Packages/rubygem-bson-doc-4.3.0-2.module_el8.5.0+2625+ec418553.noarch.rpm