Lucene search

K
centosCentOS ProjectCESA-2007:0961
HistoryNov 13, 2007 - 1:51 p.m.

irb, ruby security update

2007-11-1313:51:34
CentOS Project
lists.centos.org
42

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.049 Low

EPSS

Percentile

92.6%

CentOS Errata and Security Advisory CESA-2007:0961

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was discovered in the way Ruby’s CGI module handles certain HTTP
requests. If a remote attacker sends a specially crafted request, it is
possible to cause the ruby CGI script to enter an infinite loop, possibly
causing a denial of service. (CVE-2006-6303)

An SSL certificate validation flaw was discovered in several Ruby Net
modules. The libraries were not checking the requested host name against
the common name (CN) in the SSL server certificate, possibly allowing a man
in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Users of Ruby should upgrade to these updated packages, which contain
backported patches to resolve these issues.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2007-November/076579.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076580.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076581.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076582.html

Affected packages:
irb
ruby
ruby-devel
ruby-docs
ruby-libs
ruby-mode
ruby-tcltk

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0961

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.049 Low

EPSS

Percentile

92.6%

Related for CESA-2007:0961