(RHSA-2013:1103) Moderate: ruby193-ruby security update

2013-07-23T04:00:00
ID RHSA-2013:1103
Type redhat
Reporter RedHat
Modified 2017-03-03T17:33:20

Description

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. Red Hat OpenStack makes use of Puppet, which is written in Ruby.

A flaw was found in Ruby's SSL client's hostname identity check when handling certificates that contain hostnames with NULL bytes. An attacker could potentially exploit this flaw to conduct a man-in-the-middle attack against the Puppet master and its clients. Note that to exploit this issue, an attacker would need to get a carefully-crafted certificate signed by an authority that the Puppet master and clients trust. (CVE-2013-4073)

Users of Red Hat OpenStack 3.0 (Grizzly) are advised to upgrade to these updated packages, which correct this issue. After installing the update, the puppetmaster service must be restarted on the Puppet master server, and the puppet service must be restarted on all clients that run the Puppet agent as a daemon.