Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 483
Alerts This Week
Warning Icon 1 483

Ubuntu 24.04 LTS USN-6838-1 Moderate Ruby Remote Code Execution

ubuntu
Calendar Grey June 17, 2024
Scroller Ubuntu
Various vulnerabilities tackled within Ruby libraries for Ubuntu, highlighting possible risks of remote code execution.
Several security issues were fixed in Ruby.

Summary

Several security issues were fixed in Ruby.

Software Description:

- ruby3.2: Object-oriented scripting language

- ruby3.1: Object-oriented scripting language

- ruby3.0: Object-oriented scripting language

- ruby2.7: Object-oriented scripting language

Details:

It was discovered that Ruby RDoc incorrectly parsed certain YAML files. If

a user or automated system were tricked into parsing a specially crafted

.rdoc_options file, a remote attacker could possibly use this issue to

execute arbitrary code. (CVE-2024-27281)

It was discovered that the Ruby regex compiler incorrectly handled certain

memory operations. A remote attacker could possibly use this issue to

obtain sensitive memory contents. (CVE-2024-27282)

Topics%20covered

Topics Covered

security advisory software update remote code execution vulnerability ubuntu ruby

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   libruby3.2                      3.2.3-1ubuntu0.24.04.1
   ruby3.2                         3.2.3-1ubuntu0.24.04.1

Ubuntu 23.10
   libruby3.1                      3.1.2-7ubuntu3.2
   ruby3.1                         3.1.2-7ubuntu3.2

Ubuntu 22.04 LTS
   libruby3.0                      3.0.2-7ubuntu2.6
   ruby3.0                         3.0.2-7ubuntu2.6

Ubuntu 20.04 LTS
   libruby2.7                      2.7.0-5ubuntu1.13
   ruby2.7                         2.7.0-5ubuntu1.13

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6838-1

CVE-2024-27281, CVE-2024-27282

Severity
important
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6838-1

Topics%20covered

Topics Covered

security advisory software update remote code execution vulnerability ubuntu ruby

Package Information

https://launchpad.net/ubuntu/+source/ruby3.2/3.2.3-1ubuntu0.24.04.1
https://launchpad.net/ubuntu/+source/ruby3.1/3.1.2-7ubuntu3.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.