Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 20.04 LTS USN-5806-3 Moderate: Ruby HTTP Response Risk

ubuntu
Calendar Grey March 20, 2023
Scroller Ubuntu
A flaw in Ruby on Ubuntu 20.04 LTS may affect web traffic. Ensure your system is updated for protection.
Ruby could allow for internet traffic to be modified if a vulnerable application processed malicious user input.

Summary

Ruby could allow for internet traffic to be modified if

a vulnerable application processed malicious user input.

Software Description:

- ruby2.7: Object-oriented scripting language

Details:

USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem

for Ubuntu 20.04 LTS.

Original advisory details:

Hiroshi Tokumaru discovered that Ruby did not properly handle certain

user input for applications which generate HTTP responses using cgi gem.

An attacker could possibly use this issue to maliciously modify the

response a user would receive from a vulnerable application.

Topics%20covered

Topics Covered

security advisory Ubuntu attack vector internet traffic Ruby HTTP response application risk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  libruby2.7                      2.7.0-5ubuntu1.8
  ruby2.7                         2.7.0-5ubuntu1.8

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5806-3

https://ubuntu.com/security/notices/USN-5806-1

CVE-2021-33621

March 20, 2023

Topics%20covered

Topics Covered

security advisory Ubuntu attack vector internet traffic Ruby HTTP response application risk

Package Information

https://launchpad.net/ubuntu/+source/ruby2.7/2.7.0-5ubuntu1.8

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.