RedHatRHSA-2024:3838(RHSA-2024:3838) Moderate: ruby security update
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
77.3%
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
The following packages have been upgraded to a later upstream version: ruby
(3.0). (RHEL-35740)
Security Fix(es):
-
ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
-
ruby: ReDoS vulnerability in URI (CVE-2023-28755)
-
ruby: ReDoS vulnerability in Time (CVE-2023-28756)
-
ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
-
ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
-
ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 9 | i686 | rubygem-io-console-debuginfo | < 0.5.7-162.el9_4 | rubygem-io-console-debuginfo-0.5.7-162.el9_4.i686.rpm |
| RedHat | 9 | s390x | rubygem-io-console-debuginfo | < 0.5.7-162.el9_4 | rubygem-io-console-debuginfo-0.5.7-162.el9_4.s390x.rpm |
| RedHat | 9 | s390x | ruby-debugsource | < 3.0.7-162.el9_4 | ruby-debugsource-3.0.7-162.el9_4.s390x.rpm |
| RedHat | 9 | i686 | ruby | < 3.0.7-162.el9_4 | ruby-3.0.7-162.el9_4.i686.rpm |
| RedHat | 9 | ppc64le | ruby-debuginfo | < 3.0.7-162.el9_4 | ruby-debuginfo-3.0.7-162.el9_4.ppc64le.rpm |
| RedHat | 9 | ppc64le | rubygem-psych-debuginfo | < 3.3.2-162.el9_4 | rubygem-psych-debuginfo-3.3.2-162.el9_4.ppc64le.rpm |
| RedHat | 9 | aarch64 | ruby-libs | < 3.0.7-162.el9_4 | ruby-libs-3.0.7-162.el9_4.aarch64.rpm |
| RedHat | 9 | x86_64 | rubygem-io-console-debuginfo | < 0.5.7-162.el9_4 | rubygem-io-console-debuginfo-0.5.7-162.el9_4.x86_64.rpm |
| RedHat | 9 | ppc64le | ruby | < 3.0.7-162.el9_4 | ruby-3.0.7-162.el9_4.ppc64le.rpm |
| RedHat | 9 | ppc64le | rubygem-bigdecimal | < 3.0.0-162.el9_4 | rubygem-bigdecimal-3.0.0-162.el9_4.ppc64le.rpm |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
77.3%