Important: ruby23, ruby24

Issue Overview:

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.(CVE-2018-16395)

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.(CVE-2018-16396)

Affected Packages:

ruby23, ruby24

Issue Correction:
Run yum update ruby23 to update your system.

New Packages:

i686:  
    ruby23-devel-2.3.8-1.20.amzn1.i686  
    ruby23-libs-2.3.8-1.20.amzn1.i686  
    rubygem23-io-console-0.4.5-1.20.amzn1.i686  
    ruby23-2.3.8-1.20.amzn1.i686  
    rubygem23-json-1.8.3.1-1.20.amzn1.i686  
    rubygem23-psych-2.1.0.1-1.20.amzn1.i686  
    rubygem23-bigdecimal-1.2.8-1.20.amzn1.i686  
    ruby23-debuginfo-2.3.8-1.20.amzn1.i686  
    ruby24-libs-2.4.5-1.30.7.amzn1.i686  
    rubygem24-json-2.0.4-1.30.7.amzn1.i686  
    ruby24-2.4.5-1.30.7.amzn1.i686  
    ruby24-devel-2.4.5-1.30.7.amzn1.i686  
    rubygem24-xmlrpc-0.2.1-1.30.7.amzn1.i686  
    rubygem24-bigdecimal-1.3.2-1.30.7.amzn1.i686  
    ruby24-debuginfo-2.4.5-1.30.7.amzn1.i686  
    rubygem24-psych-2.2.2-1.30.7.amzn1.i686  
    rubygem24-io-console-0.4.6-1.30.7.amzn1.i686  
  
noarch:  
    ruby23-doc-2.3.8-1.20.amzn1.noarch  
    rubygem23-did_you_mean-1.0.0-1.20.amzn1.noarch  
    rubygems23-2.5.2.3-1.20.amzn1.noarch  
    ruby23-irb-2.3.8-1.20.amzn1.noarch  
    rubygems23-devel-2.5.2.3-1.20.amzn1.noarch  
    rubygems24-devel-2.6.14.3-1.30.7.amzn1.noarch  
    rubygem24-did_you_mean-1.1.0-1.30.7.amzn1.noarch  
    rubygems24-2.6.14.3-1.30.7.amzn1.noarch  
    ruby24-irb-2.4.5-1.30.7.amzn1.noarch  
    ruby24-doc-2.4.5-1.30.7.amzn1.noarch  
  
src:  
    ruby23-2.3.8-1.20.amzn1.src  
    ruby24-2.4.5-1.30.7.amzn1.src  
  
x86_64:  
    ruby23-devel-2.3.8-1.20.amzn1.x86_64  
    ruby23-libs-2.3.8-1.20.amzn1.x86_64  
    rubygem23-bigdecimal-1.2.8-1.20.amzn1.x86_64  
    rubygem23-io-console-0.4.5-1.20.amzn1.x86_64  
    rubygem23-psych-2.1.0.1-1.20.amzn1.x86_64  
    rubygem23-json-1.8.3.1-1.20.amzn1.x86_64  
    ruby23-debuginfo-2.3.8-1.20.amzn1.x86_64  
    ruby23-2.3.8-1.20.amzn1.x86_64  
    ruby24-libs-2.4.5-1.30.7.amzn1.x86_64  
    rubygem24-xmlrpc-0.2.1-1.30.7.amzn1.x86_64  
    ruby24-debuginfo-2.4.5-1.30.7.amzn1.x86_64  
    ruby24-devel-2.4.5-1.30.7.amzn1.x86_64  
    rubygem24-io-console-0.4.6-1.30.7.amzn1.x86_64  
    rubygem24-bigdecimal-1.3.2-1.30.7.amzn1.x86_64  
    rubygem24-psych-2.2.2-1.30.7.amzn1.x86_64  
    rubygem24-json-2.0.4-1.30.7.amzn1.x86_64  
    ruby24-2.4.5-1.30.7.amzn1.x86_64  

Additional References

Red Hat: CVE-2018-16395, CVE-2018-16396

Mitre: CVE-2018-16395, CVE-2018-16396