Important: ruby

Issue Overview:

A flaw was discovered in Ruby in the way certain functions handled strings containing NULL bytes. Specifically, the built-in methods File.fnmatch and its alias File.fnmatch? did not properly handle path patterns containing the NULL byte. A remote attacker could exploit this flaw to make a Ruby script access unexpected files and to bypass intended file system access restrictions. (CVE-2019-15845)

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF. (CVE-2019-16254)

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the “command” argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. (CVE-2021-41819)

Affected Packages:

ruby

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update ruby to update your system.

New Packages:

aarch64:  
    ruby-2.0.0.648-36.amzn2.0.7.aarch64  
    ruby-devel-2.0.0.648-36.amzn2.0.7.aarch64  
    ruby-libs-2.0.0.648-36.amzn2.0.7.aarch64  
    rubygem-bigdecimal-1.2.0-36.amzn2.0.7.aarch64  
    rubygem-io-console-0.4.2-36.amzn2.0.7.aarch64  
    rubygem-json-1.7.7-36.amzn2.0.7.aarch64  
    rubygem-psych-2.0.0-36.amzn2.0.7.aarch64  
    ruby-tcltk-2.0.0.648-36.amzn2.0.7.aarch64  
    ruby-debuginfo-2.0.0.648-36.amzn2.0.7.aarch64  
  
i686:  
    ruby-2.0.0.648-36.amzn2.0.7.i686  
    ruby-devel-2.0.0.648-36.amzn2.0.7.i686  
    ruby-libs-2.0.0.648-36.amzn2.0.7.i686  
    rubygem-bigdecimal-1.2.0-36.amzn2.0.7.i686  
    rubygem-io-console-0.4.2-36.amzn2.0.7.i686  
    rubygem-json-1.7.7-36.amzn2.0.7.i686  
    rubygem-psych-2.0.0-36.amzn2.0.7.i686  
    ruby-tcltk-2.0.0.648-36.amzn2.0.7.i686  
    ruby-debuginfo-2.0.0.648-36.amzn2.0.7.i686  
  
noarch:  
    rubygems-2.0.14.1-36.amzn2.0.7.noarch  
    rubygems-devel-2.0.14.1-36.amzn2.0.7.noarch  
    rubygem-rake-0.9.6-36.amzn2.0.7.noarch  
    ruby-irb-2.0.0.648-36.amzn2.0.7.noarch  
    rubygem-rdoc-4.0.0-36.amzn2.0.7.noarch  
    ruby-doc-2.0.0.648-36.amzn2.0.7.noarch  
    rubygem-minitest-4.3.2-36.amzn2.0.7.noarch  
  
src:  
    ruby-2.0.0.648-36.amzn2.0.7.src  
  
x86_64:  
    ruby-2.0.0.648-36.amzn2.0.7.x86_64  
    ruby-devel-2.0.0.648-36.amzn2.0.7.x86_64  
    ruby-libs-2.0.0.648-36.amzn2.0.7.x86_64  
    rubygem-bigdecimal-1.2.0-36.amzn2.0.7.x86_64  
    rubygem-io-console-0.4.2-36.amzn2.0.7.x86_64  
    rubygem-json-1.7.7-36.amzn2.0.7.x86_64  
    rubygem-psych-2.0.0-36.amzn2.0.7.x86_64  
    ruby-tcltk-2.0.0.648-36.amzn2.0.7.x86_64  
    ruby-debuginfo-2.0.0.648-36.amzn2.0.7.x86_64  

Additional References

Red Hat: CVE-2019-15845, CVE-2019-16201, CVE-2019-16254, CVE-2019-16255, CVE-2021-41819

Mitre: CVE-2019-15845, CVE-2019-16201, CVE-2019-16254, CVE-2019-16255, CVE-2021-41819