5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.057 Low
EPSS
Percentile
92.5%
Ruby is an interpreted scripting language for object-oriented programming.
A flaw was discovered in the way Ruby’s CGI module handles certain HTTP
requests. If a remote attacker sends a specially crafted request, it is
possible to cause the ruby CGI script to enter an infinite loop, possibly
causing a denial of service. (CVE-2006-6303)
An SSL certificate validation flaw was discovered in several Ruby Net
modules. The libraries were not checking the requested host name against
the common name (CN) in the SSL server certificate, possibly allowing a man
in the middle attack. (CVE-2007-5162, CVE-2007-5770)
Users of Ruby should upgrade to these updated packages, which contain
backported patches to resolve these issues.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | any | ppc | ruby-libs | < 1.8.1-7.EL4.8.1 | ruby-libs-1.8.1-7.EL4.8.1.ppc.rpm |
RedHat | any | src | ruby | < 1.8.1-7.EL4.8.1 | ruby-1.8.1-7.EL4.8.1.src.rpm |
RedHat | any | s390x | irb | < 1.8.1-7.EL4.8.1 | irb-1.8.1-7.EL4.8.1.s390x.rpm |
RedHat | any | s390x | ruby-libs | < 1.8.1-7.EL4.8.1 | ruby-libs-1.8.1-7.EL4.8.1.s390x.rpm |
RedHat | any | i386 | ruby-docs | < 1.8.1-7.EL4.8.1 | ruby-docs-1.8.1-7.EL4.8.1.i386.rpm |
RedHat | any | s390 | ruby-devel | < 1.8.1-7.EL4.8.1 | ruby-devel-1.8.1-7.EL4.8.1.s390.rpm |
RedHat | any | ia64 | ruby-tcltk | < 1.8.1-7.EL4.8.1 | ruby-tcltk-1.8.1-7.EL4.8.1.ia64.rpm |
RedHat | any | ppc | ruby-mode | < 1.8.1-7.EL4.8.1 | ruby-mode-1.8.1-7.EL4.8.1.ppc.rpm |
RedHat | any | s390x | ruby-devel | < 1.8.1-7.EL4.8.1 | ruby-devel-1.8.1-7.EL4.8.1.s390x.rpm |
RedHat | any | s390 | ruby-tcltk | < 1.8.1-7.EL4.8.1 | ruby-tcltk-1.8.1-7.EL4.8.1.s390.rpm |