Lucene search

RedHatRHSA-2023:7025

HistoryNov 14, 2023 - 8:43 a.m.

(RHSA-2023:7025) Moderate: ruby:2.5 security update

2023-11-1408:43:17

access.redhat.com

ruby scripting language

http response splitting

buffer overrun

redos vulnerability

cve-2021-33621

cve-2022-28739

cve-2023-28755

cve-2023-28756

red hat enterprise linux

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.005

Percentile

77.9%

JSON

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)
ruby: ReDoS vulnerability in URI (CVE-2023-28755)
ruby: ReDoS vulnerability in Time (CVE-2023-28756)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyppc64leruby-debuginfo< 2.5.9-111.module+el8.9.0+19193+435404aeruby-debuginfo-2.5.9-111.module+el8.9.0+19193+435404ae.ppc64le.rpm
RedHatanyx86_64ruby< 2.5.9-111.module+el8.9.0+19193+435404aeruby-2.5.9-111.module+el8.9.0+19193+435404ae.x86_64.rpm
RedHatanyppc64lerubygem-io-console< 0.4.6-111.module+el8.9.0+19193+435404aerubygem-io-console-0.4.6-111.module+el8.9.0+19193+435404ae.ppc64le.rpm
RedHatanys390xrubygem-json< 2.1.0-111.module+el8.9.0+19193+435404aerubygem-json-2.1.0-111.module+el8.9.0+19193+435404ae.s390x.rpm
RedHatanyppc64lerubygem-pg-debugsource< 1.0.0-3.module+el8.9.0+19193+435404aerubygem-pg-debugsource-1.0.0-3.module+el8.9.0+19193+435404ae.ppc64le.rpm
RedHatanyi686rubygem-json< 2.1.0-111.module+el8.9.0+19193+435404aerubygem-json-2.1.0-111.module+el8.9.0+19193+435404ae.i686.rpm
RedHatanyaarch64ruby-libs< 2.5.9-111.module+el8.9.0+19193+435404aeruby-libs-2.5.9-111.module+el8.9.0+19193+435404ae.aarch64.rpm
RedHatanyaarch64rubygem-pg-debugsource< 1.0.0-3.module+el8.9.0+19193+435404aerubygem-pg-debugsource-1.0.0-3.module+el8.9.0+19193+435404ae.aarch64.rpm
RedHatanyppc64lerubygem-io-console-debuginfo< 0.4.6-111.module+el8.9.0+19193+435404aerubygem-io-console-debuginfo-0.4.6-111.module+el8.9.0+19193+435404ae.ppc64le.rpm
RedHatanys390xrubygem-bigdecimal-debuginfo< 1.3.4-111.module+el8.9.0+19193+435404aerubygem-bigdecimal-debuginfo-1.3.4-111.module+el8.9.0+19193+435404ae.s390x.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	ppc64le	ruby-debuginfo	< 2.5.9-111.module+el8.9.0+19193+435404ae	ruby-debuginfo-2.5.9-111.module+el8.9.0+19193+435404ae.ppc64le.rpm
RedHat	any	x86_64	ruby	< 2.5.9-111.module+el8.9.0+19193+435404ae	ruby-2.5.9-111.module+el8.9.0+19193+435404ae.x86_64.rpm
RedHat	any	ppc64le	rubygem-io-console	< 0.4.6-111.module+el8.9.0+19193+435404ae	rubygem-io-console-0.4.6-111.module+el8.9.0+19193+435404ae.ppc64le.rpm
RedHat	any	s390x	rubygem-json	< 2.1.0-111.module+el8.9.0+19193+435404ae	rubygem-json-2.1.0-111.module+el8.9.0+19193+435404ae.s390x.rpm
RedHat	any	ppc64le	rubygem-pg-debugsource	< 1.0.0-3.module+el8.9.0+19193+435404ae	rubygem-pg-debugsource-1.0.0-3.module+el8.9.0+19193+435404ae.ppc64le.rpm
RedHat	any	i686	rubygem-json	< 2.1.0-111.module+el8.9.0+19193+435404ae	rubygem-json-2.1.0-111.module+el8.9.0+19193+435404ae.i686.rpm
RedHat	any	aarch64	ruby-libs	< 2.5.9-111.module+el8.9.0+19193+435404ae	ruby-libs-2.5.9-111.module+el8.9.0+19193+435404ae.aarch64.rpm
RedHat	any	aarch64	rubygem-pg-debugsource	< 1.0.0-3.module+el8.9.0+19193+435404ae	rubygem-pg-debugsource-1.0.0-3.module+el8.9.0+19193+435404ae.aarch64.rpm
RedHat	any	ppc64le	rubygem-io-console-debuginfo	< 0.4.6-111.module+el8.9.0+19193+435404ae	rubygem-io-console-debuginfo-0.4.6-111.module+el8.9.0+19193+435404ae.ppc64le.rpm
RedHat	any	s390x	rubygem-bigdecimal-debuginfo	< 1.3.4-111.module+el8.9.0+19193+435404ae	rubygem-bigdecimal-debuginfo-1.3.4-111.module+el8.9.0+19193+435404ae.s390x.rpm