Medium: ruby21

2015-05-2714:06:00

alas.aws.amazon.com

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.028 Low

EPSS

Percentile

90.6%

JSON

Issue Overview:

As discussed in an upstream announcment (https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/), Ruby’s OpenSSL extension suffers a vulnerability through overly permissive matching of hostnames, which can lead to similar bugs such as CVE-2014-1492.

Affected Packages:

ruby21

Issue Correction:
Run yum update ruby21 to update your system.

New Packages:

i686:  
    rubygem21-io-console-0.4.3-1.16.amzn1.i686  
    ruby21-debuginfo-2.1.6-1.16.amzn1.i686  
    rubygem21-bigdecimal-1.2.4-1.16.amzn1.i686  
    ruby21-2.1.6-1.16.amzn1.i686  
    rubygem21-psych-2.0.5-1.16.amzn1.i686  
    ruby21-libs-2.1.6-1.16.amzn1.i686  
    ruby21-devel-2.1.6-1.16.amzn1.i686  
  
noarch:  
    ruby21-irb-2.1.6-1.16.amzn1.noarch  
    rubygems21-devel-2.2.3-1.16.amzn1.noarch  
    rubygems21-2.2.3-1.16.amzn1.noarch  
    ruby21-doc-2.1.6-1.16.amzn1.noarch  
  
src:  
    ruby21-2.1.6-1.16.amzn1.src  
  
x86_64:  
    ruby21-devel-2.1.6-1.16.amzn1.x86_64  
    rubygem21-bigdecimal-1.2.4-1.16.amzn1.x86_64  
    ruby21-debuginfo-2.1.6-1.16.amzn1.x86_64  
    ruby21-2.1.6-1.16.amzn1.x86_64  
    rubygem21-io-console-0.4.3-1.16.amzn1.x86_64  
    ruby21-libs-2.1.6-1.16.amzn1.x86_64  
    rubygem21-psych-2.0.5-1.16.amzn1.x86_64

Additional References

Red Hat: CVE-2015-1855

Mitre: CVE-2015-1855

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686rubygem21-io-console< 0.4.3-1.16.amzn1rubygem21-io-console-0.4.3-1.16.amzn1.i686.rpm
Amazon Linux1i686ruby21-debuginfo< 2.1.6-1.16.amzn1ruby21-debuginfo-2.1.6-1.16.amzn1.i686.rpm
Amazon Linux1i686rubygem21-bigdecimal< 1.2.4-1.16.amzn1rubygem21-bigdecimal-1.2.4-1.16.amzn1.i686.rpm
Amazon Linux1i686ruby21< 2.1.6-1.16.amzn1ruby21-2.1.6-1.16.amzn1.i686.rpm
Amazon Linux1i686rubygem21-psych< 2.0.5-1.16.amzn1rubygem21-psych-2.0.5-1.16.amzn1.i686.rpm
Amazon Linux1i686ruby21-libs< 2.1.6-1.16.amzn1ruby21-libs-2.1.6-1.16.amzn1.i686.rpm
Amazon Linux1i686ruby21-devel< 2.1.6-1.16.amzn1ruby21-devel-2.1.6-1.16.amzn1.i686.rpm
Amazon Linux1noarchruby21-irb< 2.1.6-1.16.amzn1ruby21-irb-2.1.6-1.16.amzn1.noarch.rpm
Amazon Linux1noarchrubygems21-devel< 2.2.3-1.16.amzn1rubygems21-devel-2.2.3-1.16.amzn1.noarch.rpm
Amazon Linux1noarchrubygems21< 2.2.3-1.16.amzn1rubygems21-2.2.3-1.16.amzn1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	rubygem21-io-console	< 0.4.3-1.16.amzn1	rubygem21-io-console-0.4.3-1.16.amzn1.i686.rpm
Amazon Linux	1	i686	ruby21-debuginfo	< 2.1.6-1.16.amzn1	ruby21-debuginfo-2.1.6-1.16.amzn1.i686.rpm
Amazon Linux	1	i686	rubygem21-bigdecimal	< 1.2.4-1.16.amzn1	rubygem21-bigdecimal-1.2.4-1.16.amzn1.i686.rpm
Amazon Linux	1	i686	ruby21	< 2.1.6-1.16.amzn1	ruby21-2.1.6-1.16.amzn1.i686.rpm
Amazon Linux	1	i686	rubygem21-psych	< 2.0.5-1.16.amzn1	rubygem21-psych-2.0.5-1.16.amzn1.i686.rpm
Amazon Linux	1	i686	ruby21-libs	< 2.1.6-1.16.amzn1	ruby21-libs-2.1.6-1.16.amzn1.i686.rpm
Amazon Linux	1	i686	ruby21-devel	< 2.1.6-1.16.amzn1	ruby21-devel-2.1.6-1.16.amzn1.i686.rpm
Amazon Linux	1	noarch	ruby21-irb	< 2.1.6-1.16.amzn1	ruby21-irb-2.1.6-1.16.amzn1.noarch.rpm
Amazon Linux	1	noarch	rubygems21-devel	< 2.2.3-1.16.amzn1	rubygems21-devel-2.2.3-1.16.amzn1.noarch.rpm
Amazon Linux	1	noarch	rubygems21	< 2.2.3-1.16.amzn1	rubygems21-2.2.3-1.16.amzn1.noarch.rpm