(RHSA-2024:3670) Moderate: ruby:3.3 security, bug fix, and enhancement update

2024-06-0608:56:50

access.redhat.com

ruby

interpreted language

text processing

system management

buffer overread

rce vulnerability

memory address read

cve-2024-27280

cve-2024-27281

cve-2024-27282

upstream upgrade geography

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

JSON

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.3). (RHEL-37446)

Security Fix(es):

ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
ruby: Arbitrary memory address read vulnerability with Regex search
(CVE-2024-27282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanys390xrubygem-pg-debugsource< 1.5.4-1.module+el8.10.0+21226+b78a28c4rubygem-pg-debugsource-1.5.4-1.module+el8.10.0+21226+b78a28c4.s390x.rpm
RedHatanynoarchrubygem-rss< 0.3.0-2.module+el8.10.0+21860+47fbda2arubygem-rss-0.3.0-2.module+el8.10.0+21860+47fbda2a.noarch.rpm
RedHatanys390xrubygem-psych-debuginfo< 5.1.2-2.module+el8.10.0+21860+47fbda2arubygem-psych-debuginfo-5.1.2-2.module+el8.10.0+21860+47fbda2a.s390x.rpm
RedHatanynoarchrubygem-typeprof< 0.21.9-2.module+el8.10.0+21860+47fbda2arubygem-typeprof-0.21.9-2.module+el8.10.0+21860+47fbda2a.noarch.rpm
RedHatanynoarchrubygem-pg-doc< 1.5.4-1.module+el8.10.0+21226+b78a28c4rubygem-pg-doc-1.5.4-1.module+el8.10.0+21226+b78a28c4.noarch.rpm
RedHatanynoarchrubygems-devel< 3.5.9-2.module+el8.10.0+21860+47fbda2arubygems-devel-3.5.9-2.module+el8.10.0+21860+47fbda2a.noarch.rpm
RedHatanyi686ruby-debugsource< 3.3.1-2.module+el8.10.0+21860+47fbda2aruby-debugsource-3.3.1-2.module+el8.10.0+21860+47fbda2a.i686.rpm
RedHatanyi686rubygem-io-console-debuginfo< 0.7.1-2.module+el8.10.0+21860+47fbda2arubygem-io-console-debuginfo-0.7.1-2.module+el8.10.0+21860+47fbda2a.i686.rpm
RedHatanyppc64lerubygem-io-console-debuginfo< 0.7.1-2.module+el8.10.0+21860+47fbda2arubygem-io-console-debuginfo-0.7.1-2.module+el8.10.0+21860+47fbda2a.ppc64le.rpm
RedHatanynoarchrubygem-test-unit< 3.6.1-2.module+el8.10.0+21860+47fbda2arubygem-test-unit-3.6.1-2.module+el8.10.0+21860+47fbda2a.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	s390x	rubygem-pg-debugsource	< 1.5.4-1.module+el8.10.0+21226+b78a28c4	rubygem-pg-debugsource-1.5.4-1.module+el8.10.0+21226+b78a28c4.s390x.rpm
RedHat	any	noarch	rubygem-rss	< 0.3.0-2.module+el8.10.0+21860+47fbda2a	rubygem-rss-0.3.0-2.module+el8.10.0+21860+47fbda2a.noarch.rpm
RedHat	any	s390x	rubygem-psych-debuginfo	< 5.1.2-2.module+el8.10.0+21860+47fbda2a	rubygem-psych-debuginfo-5.1.2-2.module+el8.10.0+21860+47fbda2a.s390x.rpm
RedHat	any	noarch	rubygem-typeprof	< 0.21.9-2.module+el8.10.0+21860+47fbda2a	rubygem-typeprof-0.21.9-2.module+el8.10.0+21860+47fbda2a.noarch.rpm
RedHat	any	noarch	rubygem-pg-doc	< 1.5.4-1.module+el8.10.0+21226+b78a28c4	rubygem-pg-doc-1.5.4-1.module+el8.10.0+21226+b78a28c4.noarch.rpm
RedHat	any	noarch	rubygems-devel	< 3.5.9-2.module+el8.10.0+21860+47fbda2a	rubygems-devel-3.5.9-2.module+el8.10.0+21860+47fbda2a.noarch.rpm
RedHat	any	i686	ruby-debugsource	< 3.3.1-2.module+el8.10.0+21860+47fbda2a	ruby-debugsource-3.3.1-2.module+el8.10.0+21860+47fbda2a.i686.rpm
RedHat	any	i686	rubygem-io-console-debuginfo	< 0.7.1-2.module+el8.10.0+21860+47fbda2a	rubygem-io-console-debuginfo-0.7.1-2.module+el8.10.0+21860+47fbda2a.i686.rpm
RedHat	any	ppc64le	rubygem-io-console-debuginfo	< 0.7.1-2.module+el8.10.0+21860+47fbda2a	rubygem-io-console-debuginfo-0.7.1-2.module+el8.10.0+21860+47fbda2a.ppc64le.rpm
RedHat	any	noarch	rubygem-test-unit	< 3.6.1-2.module+el8.10.0+21860+47fbda2a	rubygem-test-unit-3.6.1-2.module+el8.10.0+21860+47fbda2a.noarch.rpm