Lucene search

DebianDEBIAN:DSA-5066-1:E9961

HistoryFeb 03, 2022 - 7:26 p.m.

[SECURITY] [DSA 5066-1] ruby2.5 security update

2022-02-0319:26:40

lists.debian.org

ruby2.5

security advisory

debian

cve-2021-28965

cve-2021-31799

cve-2021-31810

cve-2021-41817

cve-2021-41819

cve-2021-32066

interpreter vulnerabilities

rubygems

xml roundtrip attacks

arbitrary code execution

information disclosure

starttls stripping

imap

denial of service

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

8.6

Confidence

High

EPSS

0.01

Percentile

83.9%

JSON

Debian Security Advisory DSA-5066-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
February 03, 2022 https://www.debian.org/security/faq

Package : ruby2.5
CVE ID : CVE-2021-28965 CVE-2021-31799 CVE-2021-31810
CVE-2021-41817 CVE-2021-41819 CVE-2021-32066

Several vulnerabilities have been discovered in the interpreter for the
Ruby language and the Rubygems included, which may result on result in
XML roundtrip attacks, the execution of arbitrary code, information
disclosure, StartTLS stripping in IMAP or denial of service.

For the oldstable distribution (buster), these problems have been fixed
in version 2.5.5-3+deb10u4.

We recommend that you upgrade your ruby2.5 packages.

For the detailed security status of ruby2.5 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ruby2.5

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian11armhflibruby2.7< 2.7.4-1+deb11u1libruby2.7_2.7.4-1+deb11u1_armhf.deb
Debian11allruby2.7< 2.7.4-1+deb11u1ruby2.7_2.7.4-1+deb11u1_all.deb
Debian10s390xruby2.5< 2.5.5-3+deb10u4ruby2.5_2.5.5-3+deb10u4_s390x.deb
Debian10ppc64elruby2.5-dev< 2.5.5-3+deb10u4ruby2.5-dev_2.5.5-3+deb10u4_ppc64el.deb
Debian9armelruby2.3-tcltk< 2.3.3-1+deb9u11ruby2.3-tcltk_2.3.3-1+deb9u11_armel.deb
Debian10arm64ruby2.5< 2.5.5-3+deb10u4ruby2.5_2.5.5-3+deb10u4_arm64.deb
Debian11arm64ruby2.7< 2.7.4-1+deb11u1ruby2.7_2.7.4-1+deb11u1_arm64.deb
Debian11armhflibruby2.7-dbgsym< 2.7.4-1+deb11u1libruby2.7-dbgsym_2.7.4-1+deb11u1_armhf.deb
Debian11mipselruby2.7-dbgsym< 2.7.4-1+deb11u1ruby2.7-dbgsym_2.7.4-1+deb11u1_mipsel.deb
Debian10mipsruby2.5< 2.5.5-3+deb10u4ruby2.5_2.5.5-3+deb10u4_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	armhf	libruby2.7	< 2.7.4-1+deb11u1	libruby2.7_2.7.4-1+deb11u1_armhf.deb
Debian	11	all	ruby2.7	< 2.7.4-1+deb11u1	ruby2.7_2.7.4-1+deb11u1_all.deb
Debian	10	s390x	ruby2.5	< 2.5.5-3+deb10u4	ruby2.5_2.5.5-3+deb10u4_s390x.deb
Debian	10	ppc64el	ruby2.5-dev	< 2.5.5-3+deb10u4	ruby2.5-dev_2.5.5-3+deb10u4_ppc64el.deb
Debian	9	armel	ruby2.3-tcltk	< 2.3.3-1+deb9u11	ruby2.3-tcltk_2.3.3-1+deb9u11_armel.deb
Debian	10	arm64	ruby2.5	< 2.5.5-3+deb10u4	ruby2.5_2.5.5-3+deb10u4_arm64.deb
Debian	11	arm64	ruby2.7	< 2.7.4-1+deb11u1	ruby2.7_2.7.4-1+deb11u1_arm64.deb
Debian	11	armhf	libruby2.7-dbgsym	< 2.7.4-1+deb11u1	libruby2.7-dbgsym_2.7.4-1+deb11u1_armhf.deb
Debian	11	mipsel	ruby2.7-dbgsym	< 2.7.4-1+deb11u1	ruby2.7-dbgsym_2.7.4-1+deb11u1_mipsel.deb
Debian	10	mips	ruby2.5	< 2.5.5-3+deb10u4	ruby2.5_2.5.5-3+deb10u4_mips.deb