1. Home
  2. Security Advisories
  3. Amazon Linux
  4. ALAS-2021-1468

[ALAS-2021-1468] Amazon Linux AMI 2014.03 - ALAS-2021-1468: medium priority package update for ruby20

Severity Medium
Affected Packages 18
CVEs 1
Info Packages References Vulnerabilities

Package updates are available for Amazon Linux AMI that fix the following vulnerabilities:
CVE-2020-25613:
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
1883623: CVE-2020-25613 ruby: potential HTTP request smuggling in WEBrick

Package Affected Version
pkg:rpm/amazonlinux/rubygems20?arch=noarch&distro=amazonlinux-1 < 2.0.14.1-2.39.amzn1
pkg:rpm/amazonlinux/rubygems20-devel?arch=noarch&distro=amazonlinux-1 < 2.0.14.1-2.39.amzn1
pkg:rpm/amazonlinux/rubygem20-psych?arch=x86_64&distro=amazonlinux-1 < 2.0.0-2.39.amzn1
pkg:rpm/amazonlinux/rubygem20-psych?arch=i686&distro=amazonlinux-1 < 2.0.0-2.39.amzn1
pkg:rpm/amazonlinux/rubygem20-io-console?arch=x86_64&distro=amazonlinux-1 < 0.4.2-2.39.amzn1
pkg:rpm/amazonlinux/rubygem20-io-console?arch=i686&distro=amazonlinux-1 < 0.4.2-2.39.amzn1
pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=x86_64&distro=amazonlinux-1 < 1.2.0-2.39.amzn1
pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=i686&distro=amazonlinux-1 < 1.2.0-2.39.amzn1
pkg:rpm/amazonlinux/ruby20?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20-libs?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20-libs?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20-irb?arch=noarch&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20-doc?arch=noarch&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20-devel?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20-devel?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20-debuginfo?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
pkg:rpm/amazonlinux/ruby20-debuginfo?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.39.amzn1
ID
ALAS-2021-1468
Severity
medium
URL
https://alas.aws.amazon.com/ALAS-2021-1468.html
Published
2021-01-12T22:51:00
(3 years ago)
Modified
2021-01-13T18:21:00
(3 years ago)
Rights
Amazon Linux Security Team
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/amazonlinux/rubygems20?arch=noarch&distro=amazonlinux-1 amazonlinux rubygems20 < 2.0.14.1-2.39.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/rubygems20-devel?arch=noarch&distro=amazonlinux-1 amazonlinux rubygems20-devel < 2.0.14.1-2.39.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/rubygem20-psych?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-psych < 2.0.0-2.39.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-psych?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-psych < 2.0.0-2.39.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem20-io-console?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-io-console < 0.4.2-2.39.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-io-console?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-io-console < 0.4.2-2.39.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-bigdecimal < 1.2.0-2.39.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-bigdecimal < 1.2.0-2.39.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20 < 2.0.0.648-2.39.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20?arch=i686&distro=amazonlinux-1 amazonlinux ruby20 < 2.0.0.648-2.39.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-libs?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-libs < 2.0.0.648-2.39.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-libs?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-libs < 2.0.0.648-2.39.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-irb?arch=noarch&distro=amazonlinux-1 amazonlinux ruby20-irb < 2.0.0.648-2.39.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/ruby20-doc?arch=noarch&distro=amazonlinux-1 amazonlinux ruby20-doc < 2.0.0.648-2.39.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/ruby20-devel?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-devel < 2.0.0.648-2.39.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-devel?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-devel < 2.0.0.648-2.39.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-debuginfo?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-debuginfo < 2.0.0.648-2.39.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-debuginfo?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-debuginfo < 2.0.0.648-2.39.amzn1 amazonlinux-1 i686
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date