Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Ubuntu 20.04 LTS USN-7091-2: Ruby Security Issues and Fixes

ubuntu
Calendar Grey November 21, 2024
Scroller Ubuntu
Python security patches released for Ubuntu 22.04 LTS tackle several vulnerabilities. Key improvements implemented.
Several security issues were fixed in Ruby.

Summary

Several security issues were fixed in Ruby.

Software Description:

- ruby2.7: Object-oriented scripting language

Details:

USN-7091-1 fixed several vulnerabilities in Ruby. This update provides the

corresponding update for ruby2.7 in Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that Ruby incorrectly handled parsing of an XML document

that has specific XML characters in an attribute value using REXML gem. An

attacker could use this issue to cause Ruby to crash, resulting in a

denial of service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu

24.04 LTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123)

It was discovered that Ruby incorrectly handled parsing of an XML document

that has many entity expansions with SAX2 or pull parser API. An attacker

could use this issue to cause Ruby to crash, resulting in a denial of

service. (CVE-2024-41946)

It was discovered that Ruby incorrectly handled parsing of an XML document

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service Ubuntu update instructions software issue ruby

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
  libruby2.7                      2.7.0-5ubuntu1.15
  ruby2.7                         2.7.0-5ubuntu1.15

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-7091-2

https://ubuntu.com/security/notices/USN-7091-1

CVE-2024-35176, CVE-2024-39908, CVE-2024-41123, CVE-2024-41946,

CVE-2024-49761,

Severity
important
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7091-2

Topics%20covered

Topics Covered

security advisory denial of service Ubuntu update instructions software issue ruby

Package Information

https://launchpad.net/ubuntu/+source/ruby2.7/2.7.0-5ubuntu1.15

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.