Ubuntu 18.04 LTS / 22.04 LTS : Ruby vulnerability (USN-5806-2)

The remote Ubuntu 18.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5806-2 advisory. USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.10. Tenable has extracte...

The vulnerability of the Ruby Sinatra web application development framework lies in its name-path limitation flaws, which allow attackers to access confidential data.

The vulnerability of the Ruby Sinatra web application development framework is related to shortcomings in pathname restrictions for directories. Exploiting this vulnerability allows an attacker operating remotely to gain access to confidential data...

Oracle Linux 8 : ruby:2.5 (ELSA-2023-12064)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12064 advisory. ruby 2.5.9-110.0.1 - Fix for CVE-2022-28739 Orabug: 34824177 Tenable has extracted the preceding description block directly from the Oracle Linux security...

rubygem-rack 安全漏洞

rubygem-rack is an application in the rubygems open source. Rubygem-rack has a security vulnerability that stems from a denial of service in Content-Disposition parsing...

ruby:2.5 security update

ruby 2.5.9-110.0.1 - Fix for CVE-2022-28739 Orabug: 34824177...

rubygem-activerecord 安全漏洞

rubygem-activerecord is an application of rubygems open source. A security vulnerability exists in rubygem-activerecord that stems from the presence of a denial of service...

PT-2023-9883 · Ruby · Jruby-Openssl

Name of the Vulnerable Software and Affected Versions: jruby-openssl gem versions prior to 0.6 Description: A security issue was found in the handling of SSL certificate validation, where failed verification did not properly alert the application, making it vulnerable to attacks. This could allow...

ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, which is a paid service and not part of the rubygem, 6.1.7.1,...

GHSA-J6GC-792M-QGM2 ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, which is a paid service and not part of the rubygem, 6.1.7.1,...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the ifnonematch header in http/cache.rb. An attacker can cause resource exhaustion with a malicious If-None-Match header if a version of Ruby below 3.2.0 is in use. NOTE: Patches have been...

GHSA-8XWW-X3G3-6JCV ReDoS based DoS vulnerability in Action Dispatch

There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, 6.1.7.1, 7.0.4.1 Impact A...

ReDoS based DoS vulnerability in Action Dispatch

There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, 6.1.7.1, 7.0.4.1 Impact A...

Regular Expression Denial of Service (ReDoS)

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in uri/gid.rb, when parsing modelname values. NOTE: A patch has been released to address this issue: 1-0-model-name-redos.patch Details Denial of Service DoS describes a family of attacks, all...

ReDoS based DoS vulnerability in Active Support’s underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 6.1.7.1, 7.0.4.1 Impact A specially crafted string passed to the underscore method ca...

ReDoS based DoS vulnerability in Action Dispatch

There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795. Versions Affected: All Not affected: None Fixed Versions: 6.1.7.1, 7.0.4.1 Impact A specially crafted HTTP...

PT-2023-18701 · Ruby On Rails +4 · Action Dispatch +4

Name of the Vulnerable Software and Affected Versions: Action Dispatch versions prior to 6.1.7.1 Action Dispatch versions prior to 7.0.4.1 Description: The issue is related to insufficient input validation in the Action Dispatch component of Ruby on Rails, which can lead to a denial of service Do...

Ubuntu: Security Advisory (USN-5806-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Regular Expression Denial of Service (ReDoS)

Overview sisimai is a Ruby library for analyzing RFC5322 bounce emails and generating structured data from parsed results. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expressions in the function toplain of the...

USN-5806-1 ruby2.3 vulnerability

Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application...