1. Home
  2. Security Advisories
  3. Amazon Linux
  4. ALAS-2021-1505

[ALAS-2021-1505] Amazon Linux AMI 2014.03 - ALAS-2021-1505: low priority package update for ruby20

Severity Low
Affected Packages 18
CVEs 1
Info Packages References Vulnerabilities

Package updates are available for Amazon Linux AMI that fix the following vulnerabilities:
CVE-2021-31799:
RDoc before version 6.3.1 used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with "|" and ends with "tags", the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run the rdoc command.

Package Affected Version
pkg:rpm/amazonlinux/rubygems20?arch=noarch&distro=amazonlinux-1 < 2.0.14.1-2.40.amzn1
pkg:rpm/amazonlinux/rubygems20-devel?arch=noarch&distro=amazonlinux-1 < 2.0.14.1-2.40.amzn1
pkg:rpm/amazonlinux/rubygem20-psych?arch=x86_64&distro=amazonlinux-1 < 2.0.0-2.40.amzn1
pkg:rpm/amazonlinux/rubygem20-psych?arch=i686&distro=amazonlinux-1 < 2.0.0-2.40.amzn1
pkg:rpm/amazonlinux/rubygem20-io-console?arch=x86_64&distro=amazonlinux-1 < 0.4.2-2.40.amzn1
pkg:rpm/amazonlinux/rubygem20-io-console?arch=i686&distro=amazonlinux-1 < 0.4.2-2.40.amzn1
pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=x86_64&distro=amazonlinux-1 < 1.2.0-2.40.amzn1
pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=i686&distro=amazonlinux-1 < 1.2.0-2.40.amzn1
pkg:rpm/amazonlinux/ruby20?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20-libs?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20-libs?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20-irb?arch=noarch&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20-doc?arch=noarch&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20-devel?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20-devel?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20-debuginfo?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
pkg:rpm/amazonlinux/ruby20-debuginfo?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.40.amzn1
ID
ALAS-2021-1505
Severity
low
URL
https://alas.aws.amazon.com/ALAS-2021-1505.html
Published
2021-05-20T21:12:00
(3 years ago)
Modified
2021-05-21T18:50:00
(3 years ago)
Rights
Amazon Linux Security Team
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/amazonlinux/rubygems20?arch=noarch&distro=amazonlinux-1 amazonlinux rubygems20 < 2.0.14.1-2.40.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/rubygems20-devel?arch=noarch&distro=amazonlinux-1 amazonlinux rubygems20-devel < 2.0.14.1-2.40.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/rubygem20-psych?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-psych < 2.0.0-2.40.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-psych?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-psych < 2.0.0-2.40.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem20-io-console?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-io-console < 0.4.2-2.40.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-io-console?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-io-console < 0.4.2-2.40.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-bigdecimal < 1.2.0-2.40.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-bigdecimal < 1.2.0-2.40.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20 < 2.0.0.648-2.40.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20?arch=i686&distro=amazonlinux-1 amazonlinux ruby20 < 2.0.0.648-2.40.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-libs?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-libs < 2.0.0.648-2.40.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-libs?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-libs < 2.0.0.648-2.40.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-irb?arch=noarch&distro=amazonlinux-1 amazonlinux ruby20-irb < 2.0.0.648-2.40.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/ruby20-doc?arch=noarch&distro=amazonlinux-1 amazonlinux ruby20-doc < 2.0.0.648-2.40.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/ruby20-devel?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-devel < 2.0.0.648-2.40.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-devel?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-devel < 2.0.0.648-2.40.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-debuginfo?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-debuginfo < 2.0.0.648-2.40.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-debuginfo?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-debuginfo < 2.0.0.648-2.40.amzn1 amazonlinux-1 i686
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date