Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 530
Alerts This Week
Warning Icon 1 530

Red Hat EUS: RHSA-2018:3731-01 Important: Ruby Security Fix

red hat
Calendar Grey November 29, 2018
Dist Redhat Esm H88
Important security and bug fix update for rh-ruby25-ruby in Red Hat Software Collections. Keep your system secure.
An update for rh-ruby25-ruby is now available for Red Hat Software Collections

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
The following packages have been upgraded to a later upstream version: rh-ruby25-ruby (2.5.3), rh-ruby25-rubygems (2.7.6), rh-ruby25-rubygem-openssl (2.1.2). (BZ#1650588)
Security Fix(es):
* ruby: OpenSSL::X509::Name equality check does not work correctly (CVE-2018-16395)
* ruby: HTTP response splitting in WEBrick (CVE-2017-17742)
* ruby: DoS by large request in WEBrick (CVE-2018-8777)
* ruby: Buffer under-read in String#unpack (CVE-2018-8778)
* ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780)
* ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396)
* rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073)
* rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074)
* rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076)
* rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077)
* rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078)
* rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079)
* ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914)
* ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779)
* rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow red hat important ruby update software collections

References

https://access.redhat.com/security/cve/CVE-2017-17742 https://access.redhat.com/security/cve/CVE-2018-6914 https://access.redhat.com/security/cve/CVE-2018-8777 https://access.redhat.com/security/cve/CVE-2018-8778 https://access.redhat.com/security/cve/CVE-2018-8779 https://access.redhat.com/security/cve/CVE-2018-8780 https://access.redhat.com/security/cve/CVE-2018-16395 https://access.redhat.com/security/cve/CVE-2018-16396 https://access.redhat.com/security/cve/CVE-2018-1000073 https://access.redhat.com/security/cve/CVE-2018-1000074 https://access.redhat.com/security/cve/CVE-2018-1000075 https://access.redhat.com/security/cve/CVE-2018-1000076 https://access.redhat.com/security/cve/CVE-2018-1000077 https://access.redhat.com/security/cve/CVE-2018-1000078 https://access.redhat.com/security/cve/CVE-2018-1000079 https://access.redhat.com/security/updates/classification#important

Package List

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source: rh-ruby25-ruby-2.5.3-6.el7.src.rpm
aarch64: rh-ruby25-ruby-2.5.3-6.el7.aarch64.rpm rh-ruby25-ruby-debuginfo-2.5.3-6.el7.aarch64.rpm rh-ruby25-ruby-devel-2.5.3-6.el7.aarch64.rpm rh-ruby25-ruby-libs-2.5.3-6.el7.aarch64.rpm rh-ruby25-rubygem-bigdecimal-1.3.4-6.el7.aarch64.rpm rh-ruby25-rubygem-io-console-0.4.6-6.el7.aarch64.rpm rh-ruby25-rubygem-json-2.1.0-6.el7.aarch64.rpm rh-ruby25-rubygem-openssl-2.1.2-6.el7.aarch64.rpm rh-ruby25-rubygem-psych-3.0.2-6.el7.aarch64.rpm
noarch: rh-ruby25-ruby-doc-2.5.3-6.el7.noarch.rpm rh-ruby25-ruby-irb-2.5.3-6.el7.noarch.rpm rh-ruby25-rubygem-did_you_mean-1.2.0-6.el7.noarch.rpm rh-ruby25-rubygem-minitest-5.10.3-6.el7.noarch.rpm rh-ruby25-rubygem-net-telnet-0.1.1-6.el7.noarch.rpm rh-ruby25-rubygem-power_assert-1.1.1-6.el7.noarch.rpm rh-ruby25-rubygem-rake-12.3.0-6.el7.noarch.rpm rh-ruby25-rubygem-rdoc-6.0.1-6.el7.noarch.rpm rh-ruby25-rubygem-test-unit-3.2.7-6.el7.noarch.rpm rh-ruby25-rubygem-xmlrpc-0.3.0-6.el7.noarch.rpm rh-ruby25-rubygems-2.7.6-6.el7.noarch.rpm rh-ruby25-rubygems-devel-2.7.6-6.el7.noarch.rpm
ppc64le: rh-ruby25-ruby-2.5.3-6.el7.ppc64le.rpm rh-ruby25-ruby-debuginfo-2.5.3-6.el7.ppc64le.rpm rh-ruby25-ruby-devel-2.5.3-6.el7.ppc64le.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2018:3731-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2018:3731
Issue date: 2018-11-29

Topic

An update for rh-ruby25-ruby is now available for Red Hat SoftwareCollections.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow red hat important ruby update software collections

Relevant Releases Architectures

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - aarch64, noarch, ppc64le, s390x, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - noarch, ppc64le, s390x, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - noarch, ppc64le, s390x, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - noarch, ppc64le, s390x, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Bugs Fixed

1547418 - CVE-2018-1000073 rubygems: Path traversal when writing to a symlinked basedir outside of the root

1547419 - CVE-2018-1000074 rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML

1547420 - CVE-2018-1000075 rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service

1547421 - CVE-2018-1000076 rubygems: Improper verification of signatures in tarball allows to install mis-signed gem

1547422 - CVE-2018-1000077 rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL

1547425 - CVE-2018-1000078 rubygems: XSS vulnerability in homepage attribute when displayed via gem server

1547426 - CVE-2018-1000079 rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations

1561947 - CVE-2018-6914 ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir

1561948 - CVE-2018-8779 ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket

1561949 - CVE-2018-8780 ruby: Unintentional directory traversal by poisoned NULL byte in Dir

1561950 - CVE-2018-8777 ruby: DoS by large request in WEBrick

1561952 - CVE-2017-17742 ruby: HTTP response splitting in WEBrick

1561953 - CVE-2018-8778 ruby: Buffer under-read in String#unpack

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.