5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.049 Low
EPSS
Percentile
92.6%
CentOS Errata and Security Advisory CESA-2007:0961
Ruby is an interpreted scripting language for object-oriented programming.
A flaw was discovered in the way Ruby’s CGI module handles certain HTTP
requests. If a remote attacker sends a specially crafted request, it is
possible to cause the ruby CGI script to enter an infinite loop, possibly
causing a denial of service. (CVE-2006-6303)
An SSL certificate validation flaw was discovered in several Ruby Net
modules. The libraries were not checking the requested host name against
the common name (CN) in the SSL server certificate, possibly allowing a man
in the middle attack. (CVE-2007-5162, CVE-2007-5770)
Users of Ruby should upgrade to these updated packages, which contain
backported patches to resolve these issues.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2007-November/076579.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076580.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076581.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076582.html
Affected packages:
irb
ruby
ruby-devel
ruby-docs
ruby-libs
ruby-mode
ruby-tcltk
Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0961
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 4 | ia64 | irb | < 1.8.1-7.EL4.8.1 | irb-1.8.1-7.EL4.8.1.ia64.rpm |
CentOS | 4 | ia64 | ruby | < 1.8.1-7.EL4.8.1 | ruby-1.8.1-7.EL4.8.1.ia64.rpm |
CentOS | 4 | ia64 | ruby-devel | < 1.8.1-7.EL4.8.1 | ruby-devel-1.8.1-7.EL4.8.1.ia64.rpm |
CentOS | 4 | ia64 | ruby-docs | < 1.8.1-7.EL4.8.1 | ruby-docs-1.8.1-7.EL4.8.1.ia64.rpm |
CentOS | 4 | ia64 | ruby-libs | < 1.8.1-7.EL4.8.1 | ruby-libs-1.8.1-7.EL4.8.1.ia64.rpm |
CentOS | 4 | ia64 | ruby-mode | < 1.8.1-7.EL4.8.1 | ruby-mode-1.8.1-7.EL4.8.1.ia64.rpm |
CentOS | 4 | ia64 | ruby-tcltk | < 1.8.1-7.EL4.8.1 | ruby-tcltk-1.8.1-7.EL4.8.1.ia64.rpm |
CentOS | 4 | s390 | irb | < 1.8.1-7.EL4.8.1 | irb-1.8.1-7.EL4.8.1.s390.rpm |
CentOS | 4 | s390 | ruby | < 1.8.1-7.EL4.8.1 | ruby-1.8.1-7.EL4.8.1.s390.rpm |
CentOS | 4 | s390 | ruby-devel | < 1.8.1-7.EL4.8.1 | ruby-devel-1.8.1-7.EL4.8.1.s390.rpm |