(RHSA-2024:3546) Moderate: ruby:3.1 security, bug fix, and enhancement update

2024-06-0306:57:31

access.redhat.com

ruby

security update

rce

buffer overread

regex vulnerability

red hat enterprise linux 8.10

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

5.7

Confidence

Low

JSON

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyi686rubygem-rbs< 2.7.0-143.module+el8.10.0+21792+e2f63d26rubygem-rbs-2.7.0-143.module+el8.10.0+21792+e2f63d26.i686.rpm
RedHatanyaarch64ruby< 3.1.5-143.module+el8.10.0+21792+e2f63d26ruby-3.1.5-143.module+el8.10.0+21792+e2f63d26.aarch64.rpm
RedHatanyaarch64rubygem-pg< 1.3.2-1.module+el8.10.0+21470+43ec8058rubygem-pg-1.3.2-1.module+el8.10.0+21470+43ec8058.aarch64.rpm
RedHatanyi686ruby-bundled-gems< 3.1.5-143.module+el8.10.0+21792+e2f63d26ruby-bundled-gems-3.1.5-143.module+el8.10.0+21792+e2f63d26.i686.rpm
RedHatanyi686rubygem-psych-debuginfo< 4.0.4-143.module+el8.10.0+21792+e2f63d26rubygem-psych-debuginfo-4.0.4-143.module+el8.10.0+21792+e2f63d26.i686.rpm
RedHatanynoarchrubygem-mysql2-doc< 0.5.3-3.module+el8.10.0+21470+43ec8058rubygem-mysql2-doc-0.5.3-3.module+el8.10.0+21470+43ec8058.noarch.rpm
RedHatanyppc64lerubygem-io-console-debuginfo< 0.5.11-143.module+el8.10.0+21792+e2f63d26rubygem-io-console-debuginfo-0.5.11-143.module+el8.10.0+21792+e2f63d26.ppc64le.rpm
RedHatanynoarchrubygem-rake< 13.0.6-143.module+el8.10.0+21792+e2f63d26rubygem-rake-13.0.6-143.module+el8.10.0+21792+e2f63d26.noarch.rpm
RedHatanyppc64lerubygem-psych-debuginfo< 4.0.4-143.module+el8.10.0+21792+e2f63d26rubygem-psych-debuginfo-4.0.4-143.module+el8.10.0+21792+e2f63d26.ppc64le.rpm
RedHatanyi686ruby-devel< 3.1.5-143.module+el8.10.0+21792+e2f63d26ruby-devel-3.1.5-143.module+el8.10.0+21792+e2f63d26.i686.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	i686	rubygem-rbs	< 2.7.0-143.module+el8.10.0+21792+e2f63d26	rubygem-rbs-2.7.0-143.module+el8.10.0+21792+e2f63d26.i686.rpm
RedHat	any	aarch64	ruby	< 3.1.5-143.module+el8.10.0+21792+e2f63d26	ruby-3.1.5-143.module+el8.10.0+21792+e2f63d26.aarch64.rpm
RedHat	any	aarch64	rubygem-pg	< 1.3.2-1.module+el8.10.0+21470+43ec8058	rubygem-pg-1.3.2-1.module+el8.10.0+21470+43ec8058.aarch64.rpm
RedHat	any	i686	ruby-bundled-gems	< 3.1.5-143.module+el8.10.0+21792+e2f63d26	ruby-bundled-gems-3.1.5-143.module+el8.10.0+21792+e2f63d26.i686.rpm
RedHat	any	i686	rubygem-psych-debuginfo	< 4.0.4-143.module+el8.10.0+21792+e2f63d26	rubygem-psych-debuginfo-4.0.4-143.module+el8.10.0+21792+e2f63d26.i686.rpm
RedHat	any	noarch	rubygem-mysql2-doc	< 0.5.3-3.module+el8.10.0+21470+43ec8058	rubygem-mysql2-doc-0.5.3-3.module+el8.10.0+21470+43ec8058.noarch.rpm
RedHat	any	ppc64le	rubygem-io-console-debuginfo	< 0.5.11-143.module+el8.10.0+21792+e2f63d26	rubygem-io-console-debuginfo-0.5.11-143.module+el8.10.0+21792+e2f63d26.ppc64le.rpm
RedHat	any	noarch	rubygem-rake	< 13.0.6-143.module+el8.10.0+21792+e2f63d26	rubygem-rake-13.0.6-143.module+el8.10.0+21792+e2f63d26.noarch.rpm
RedHat	any	ppc64le	rubygem-psych-debuginfo	< 4.0.4-143.module+el8.10.0+21792+e2f63d26	rubygem-psych-debuginfo-4.0.4-143.module+el8.10.0+21792+e2f63d26.ppc64le.rpm
RedHat	any	i686	ruby-devel	< 3.1.5-143.module+el8.10.0+21792+e2f63d26	ruby-devel-3.1.5-143.module+el8.10.0+21792+e2f63d26.i686.rpm