ruby security update

2024-06-1300:00:00

linux.oracle.com

ruby update

http response splitting

redos vulnerability

buffer overread

rce vulnerability

arbitrary memory read

openssl security

git submodule

tzdata

double free

buffer overrun

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.8%

JSON

[3.0.7-162]

Upgrade to Ruby 3.0.7.
Resolves: RHEL-35740
Fix HTTP response splitting in CGI.
Resolves: RHEL-35741
Fix ReDoS vulnerability in URI.
Resolves: RHEL-35742
Fix ReDoS vulnerability in Time.
Resolves: RHEL-35743
Fix buffer overread vulnerability in StringIO.
Resolves: RHEL-35744
Fix RCE vulnerability with .rdoc_options in RDoc.
Resolves: RHEL-35746
Fix arbitrary memory address read vulnerability with Regex search.
Resolves: RHEL-35747
[3.0.4-161]
Fix OpenSSL.fips_mode and OpenSSL::PKey.read in OpenSSL 3 FIPS.
Resolves: RHEL-12724
ssl: use ffdhe2048 from RFC 7919 as the default DH group parameters
Related: RHEL-12724
[3.0.4-160]
Bypass git submodule test failure on Git >= 2.38.1.
Fix tests with Europe/Amsterdam pre-1970 time on tzdata version 2022b.
Fix for tzdata-2022g.
Fix File.utime test.
[3.0.4-160]
Upgrade to Ruby 3.0.4.
Resolves: rhbz#2096347
OpenSSL test suite fixes due to disabled SHA1.
Resolves: rbhz#2107696
Fix double free in Regexp compilation.
Resolves: CVE-2022-28738
Fix buffer overrun in String-to-Float conversion.
Resolves: CVE-2022-28739

OSVersionArchitecturePackageVersionFilename
oracle linux9srcruby< 3.0.7-162.el9_4ruby-3.0.7-162.el9_4.src.rpm
oracle linux9srcruby< 3.0.7-162.el9_4ruby-3.0.7-162.el9_4.src.rpm
oracle linux9aarch64ruby< 3.0.7-162.el9_4ruby-3.0.7-162.el9_4.aarch64.rpm
oracle linux9noarchruby-default-gems< 3.0.7-162.el9_4ruby-default-gems-3.0.7-162.el9_4.noarch.rpm
oracle linux9aarch64ruby-devel< 3.0.7-162.el9_4ruby-devel-3.0.7-162.el9_4.aarch64.rpm
oracle linux9noarchruby-doc< 3.0.7-162.el9_4ruby-doc-3.0.7-162.el9_4.noarch.rpm
oracle linux9aarch64ruby-libs< 3.0.7-162.el9_4ruby-libs-3.0.7-162.el9_4.aarch64.rpm
oracle linux9aarch64rubygem-bigdecimal< 3.0.0-162.el9_4rubygem-bigdecimal-3.0.0-162.el9_4.aarch64.rpm
oracle linux9noarchrubygem-bundler< 2.2.33-162.el9_4rubygem-bundler-2.2.33-162.el9_4.noarch.rpm
oracle linux9aarch64rubygem-io-console< 0.5.7-162.el9_4rubygem-io-console-0.5.7-162.el9_4.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	9	src	ruby	< 3.0.7-162.el9_4	ruby-3.0.7-162.el9_4.src.rpm
oracle linux	9	src	ruby	< 3.0.7-162.el9_4	ruby-3.0.7-162.el9_4.src.rpm
oracle linux	9	aarch64	ruby	< 3.0.7-162.el9_4	ruby-3.0.7-162.el9_4.aarch64.rpm
oracle linux	9	noarch	ruby-default-gems	< 3.0.7-162.el9_4	ruby-default-gems-3.0.7-162.el9_4.noarch.rpm
oracle linux	9	aarch64	ruby-devel	< 3.0.7-162.el9_4	ruby-devel-3.0.7-162.el9_4.aarch64.rpm
oracle linux	9	noarch	ruby-doc	< 3.0.7-162.el9_4	ruby-doc-3.0.7-162.el9_4.noarch.rpm
oracle linux	9	aarch64	ruby-libs	< 3.0.7-162.el9_4	ruby-libs-3.0.7-162.el9_4.aarch64.rpm
oracle linux	9	aarch64	rubygem-bigdecimal	< 3.0.0-162.el9_4	rubygem-bigdecimal-3.0.0-162.el9_4.aarch64.rpm
oracle linux	9	noarch	rubygem-bundler	< 2.2.33-162.el9_4	rubygem-bundler-2.2.33-162.el9_4.noarch.rpm
oracle linux	9	aarch64	rubygem-io-console	< 0.5.7-162.el9_4	rubygem-io-console-0.5.7-162.el9_4.aarch64.rpm