Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 415
Alerts This Week
Warning Icon 1 415

RedHat: RHSA-2022-0672-01 Moderate: Ruby 2.5 Command Injection

red hat
Calendar Grey February 24, 2022
Dist Redhat Esm H88
Significant patch released for Ruby 2.5 on CentOS to tackle various security flaws.
An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
* rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)
* ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)
* ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory update Red Hat Enterprise Linux ruby command injection StartTLS stripping FTP response

References

https://access.redhat.com/security/cve/CVE-2021-31799 https://access.redhat.com/security/cve/CVE-2021-31810 https://access.redhat.com/security/cve/CVE-2021-32066 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: ruby-2.5.9-109.module+el8.5.0+14275+d9c243ca.src.rpm rubygem-abrt-0.3.0-4.module+el8.1.0+3656+f80bfa1d.src.rpm rubygem-bson-4.3.0-2.module+el8.1.0+3656+f80bfa1d.src.rpm rubygem-bundler-1.16.1-4.module+el8.5.0+13840+ec418553.src.rpm rubygem-mongo-2.5.1-2.module+el8.1.0+3656+f80bfa1d.src.rpm rubygem-mysql2-0.4.10-4.module+el8.1.0+3656+f80bfa1d.src.rpm rubygem-pg-1.0.0-2.module+el8.1.0+3656+f80bfa1d.src.rpm
aarch64: ruby-2.5.9-109.module+el8.5.0+14275+d9c243ca.aarch64.rpm ruby-debuginfo-2.5.9-109.module+el8.5.0+14275+d9c243ca.aarch64.rpm ruby-debugsource-2.5.9-109.module+el8.5.0+14275+d9c243ca.aarch64.rpm ruby-devel-2.5.9-109.module+el8.5.0+14275+d9c243ca.aarch64.rpm ruby-libs-2.5.9-109.module+el8.5.0+14275+d9c243ca.aarch64.rpm ruby-libs-debuginfo-2.5.9-109.module+el8.5.0+14275+d9c243ca.aarch64.rpm rubygem-bigdecimal-1.3.4-109.module+el8.5.0+14275+d9c243ca.aarch64.rpm rubygem-bigdecimal-debuginfo-1.3.4-109.module+el8.5.0+14275+d9c243ca.aarch64.rpm rubygem-bson-4.3.0-2.module+el8.1.0+3656+f80bfa1d.aarch64.rpm rubygem-bson-debuginfo-4.3.0-2.module+el8.1.0+3656+f80bfa1d.aarch64.rpm rubygem-bson-debugsource-4.3.0-2.module+el8.1.0+3656+f80bfa1d.aarch64.rpm

Read the Full Advisory


Advisory ID: RHSA-2022:0672-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:0672
Issue date: 2022-02-24

Topic

An update for the ruby:2.5 module is now available for Red Hat EnterpriseLinux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory update Red Hat Enterprise Linux ruby command injection StartTLS stripping FTP response

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

1980126 - CVE-2021-31810 ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host

1980128 - CVE-2021-32066 ruby: StartTLS stripping vulnerability in Net::IMAP

1980132 - CVE-2021-31799 rubygem-rdoc: Command injection vulnerability in RDoc

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.