Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 555
Alerts This Week
Warning Icon 1 555

Debian 9: DLA-2330-1 Moderate: JRuby Security Update for Multiple Issues

debian lts
Calendar Grey August 16, 2020
Dist Debian Esm H88
Ubuntu Security Notice USN-4601-1 details various OpenSSL vulnerabilities and issues. Immediate update advised for protection.
Several vulnerabilities were fixed in JRuby, a 100% pure-Java implementation of Ruby
Topics%20covered

Topics Covered

security advisory denial of service debian arbitrary code http server jruby

Summary

CVE-2017-17742
CVE-2019-16254

HTTP Response Splitting attacks in the HTTP server of WEBrick.

CVE-2019-16201

Regular Expression Denial of Service vulnerability of WEBrick's
Digest access authentication.

CVE-2019-8320

Delete directory using symlink when decompressing tar.

CVE-2019-8321

Escape sequence injection vulnerability in verbose.

CVE-2019-8322

Escape sequence injection vulnerability in gem owner.

CVE-2019-8323

Escape sequence injection vulnerability in API response handling.

CVE-2019-8324

Installing a malicious gem may lead to arbitrary code execution.

CVE-2019-8325

Escape sequence injection vulnerability in errors.

CVE-2019-16255

Code injection vulnerability of Shell#[] and Shell#test.

For Debian 9 stretch, these problems have been fixed in version
1.7.26-1+deb9u2.

We recommend that you upgrade your jruby packages.

For the detailed security status of jruby please refer to
its security tracker page at:

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Package: jruby
Version: 1.7.26-1+deb9u2
CVE ID: CVE-2017-17742 CVE-2019-8320 CVE-2019-8321 CVE-2019-8322
Debian Bug: 925987

Topics%20covered

Topics Covered

security advisory denial of service debian arbitrary code http server jruby

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.