ruby security update

2024-07-1500:00:00

linux.oracle.com

ruby

security update

redos vulnerability

buffer overread

rce vulnerability

arbitrary memory address read

rexml dos

rubygem-abrt

rubygem-bson

rubygem-bundler

rubygem-mongo

rubygem-mysql2

rubygem-pg

unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

Low

EPSS

0.001

Percentile

51.2%

JSON

ruby
[2.5.9-112]

Fix ReDoS vulnerability - upstream’s incomplete fix for CVE-2023-28755.
(CVE-2023-36617)
Resolves: RHEL-5614
Fix Buffer overread vulnerability in StringIO.
(CVE-2024-27280)
Resolves: RHEL-34125
Fix RCE vulnerability with .rdoc_options in RDoc.
(CVE-2024-27281)
Resolves: RHEL-34117
Fix Arbitrary memory address read vulnerability with Regex search.
(CVE-2024-27282)
Resolves: RHEL-33867
Fix REXML DoS parsing an XML with many <'s in an attribute value.
(CVE-2024-35176)
Resolves: RHEL-37877
rubygem-abrt
rubygem-bson
rubygem-bundler
rubygem-mongo
rubygem-mysql2
rubygem-pg

OSVersionArchitecturePackageVersionFilename
oracle linux8srcruby< 2.5.9-112.moduleruby-2.5.9-112.module+el8.10.0+90367+ae9e8511.src.rpm
oracle linux8srcrubygem-abrt< 0.3.0-4.modulerubygem-abrt-0.3.0-4.module+el8.10.0+90367+ae9e8511.src.rpm
oracle linux8srcrubygem-bson< 4.3.0-2.modulerubygem-bson-4.3.0-2.module+el8.9.0+90042+a65659a6.src.rpm
oracle linux8srcrubygem-bundler< 1.16.1-4.modulerubygem-bundler-1.16.1-4.module+el8.10.0+90367+ae9e8511.src.rpm
oracle linux8srcrubygem-mongo< 2.5.1-2.modulerubygem-mongo-2.5.1-2.module+el8.9.0+90042+a65659a6.src.rpm
oracle linux8srcrubygem-mysql2< 0.4.10-4.modulerubygem-mysql2-0.4.10-4.module+el8.9.0+90042+a65659a6.src.rpm
oracle linux8srcrubygem-pg< 1.0.0-3.modulerubygem-pg-1.0.0-3.module+el8.9.0+90042+a65659a6.src.rpm
oracle linux8aarch64ruby< 2.5.9-112.moduleruby-2.5.9-112.module+el8.10.0+90367+ae9e8511.aarch64.rpm
oracle linux8aarch64ruby-devel< 2.5.9-112.moduleruby-devel-2.5.9-112.module+el8.10.0+90367+ae9e8511.aarch64.rpm
oracle linux8noarchruby-doc< 2.5.9-112.moduleruby-doc-2.5.9-112.module+el8.10.0+90367+ae9e8511.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	8	src	ruby	< 2.5.9-112.module	ruby-2.5.9-112.module+el8.10.0+90367+ae9e8511.src.rpm
oracle linux	8	src	rubygem-abrt	< 0.3.0-4.module	rubygem-abrt-0.3.0-4.module+el8.10.0+90367+ae9e8511.src.rpm
oracle linux	8	src	rubygem-bson	< 4.3.0-2.module	rubygem-bson-4.3.0-2.module+el8.9.0+90042+a65659a6.src.rpm
oracle linux	8	src	rubygem-bundler	< 1.16.1-4.module	rubygem-bundler-1.16.1-4.module+el8.10.0+90367+ae9e8511.src.rpm
oracle linux	8	src	rubygem-mongo	< 2.5.1-2.module	rubygem-mongo-2.5.1-2.module+el8.9.0+90042+a65659a6.src.rpm
oracle linux	8	src	rubygem-mysql2	< 0.4.10-4.module	rubygem-mysql2-0.4.10-4.module+el8.9.0+90042+a65659a6.src.rpm
oracle linux	8	src	rubygem-pg	< 1.0.0-3.module	rubygem-pg-1.0.0-3.module+el8.9.0+90042+a65659a6.src.rpm
oracle linux	8	aarch64	ruby	< 2.5.9-112.module	ruby-2.5.9-112.module+el8.10.0+90367+ae9e8511.aarch64.rpm
oracle linux	8	aarch64	ruby-devel	< 2.5.9-112.module	ruby-devel-2.5.9-112.module+el8.10.0+90367+ae9e8511.aarch64.rpm
oracle linux	8	noarch	ruby-doc	< 2.5.9-112.module	ruby-doc-2.5.9-112.module+el8.10.0+90367+ae9e8511.noarch.rpm