(RHSA-2008:0895) Moderate: ruby security update

2008-10-2100:00:00

access.redhat.com

0.349 Low

EPSS

Percentile

97.1%

JSON

Ruby is an interpreted scripting language for quick and easy
object-oriented programming.

A number of flaws were found in the safe-level restrictions in Ruby. It
was possible for an attacker to create a carefully crafted malicious script
that can allow the bypass of certain safe-level restrictions. (CVE-2008-3655)

A denial of service flaw was found in Ruby’s regular expression engine. If
a Ruby script tried to process a large amount of data via a regular
expression, it could cause Ruby to enter an infinite-loop and crash.
(CVE-2008-3443)

Users of ruby should upgrade to these updated packages, which contain
backported patches to resolve these issues.

OSVersionArchitecturePackageVersionFilename
RedHat2i386ruby-devel< 1.6.4-7.el2ruby-devel-1.6.4-7.el2.i386.rpm
RedHat2i386ruby-tcltk< 1.6.4-7.el2ruby-tcltk-1.6.4-7.el2.i386.rpm
RedHat2i386ruby-libs< 1.6.4-7.el2ruby-libs-1.6.4-7.el2.i386.rpm
RedHat2i386irb< 1.6.4-7.el2irb-1.6.4-7.el2.i386.rpm
RedHat2i386ruby< 1.6.4-7.el2ruby-1.6.4-7.el2.i386.rpm
RedHat2i386ruby-docs< 1.6.4-7.el2ruby-docs-1.6.4-7.el2.i386.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	2	i386	ruby-devel	< 1.6.4-7.el2	ruby-devel-1.6.4-7.el2.i386.rpm
RedHat	2	i386	ruby-tcltk	< 1.6.4-7.el2	ruby-tcltk-1.6.4-7.el2.i386.rpm
RedHat	2	i386	ruby-libs	< 1.6.4-7.el2	ruby-libs-1.6.4-7.el2.i386.rpm
RedHat	2	i386	irb	< 1.6.4-7.el2	irb-1.6.4-7.el2.i386.rpm
RedHat	2	i386	ruby	< 1.6.4-7.el2	ruby-1.6.4-7.el2.i386.rpm
RedHat	2	i386	ruby-docs	< 1.6.4-7.el2	ruby-docs-1.6.4-7.el2.i386.rpm