1. Home
  2. Security Advisories
  3. Amazon Linux
  4. ALAS-2022-1638

[ALAS-2022-1638] Amazon Linux AMI 2014.03 - ALAS-2022-1638: medium priority package update for ruby20

Severity Medium
Affected Packages 18
CVEs 1
Info Packages References Vulnerabilities

Package updates are available for Amazon Linux AMI that fix the following vulnerabilities:
CVE-2022-28739:
A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. This flaw may cause an illegal memory read.

Package Affected Version
pkg:rpm/amazonlinux/rubygems20?arch=noarch&distro=amazonlinux-1 < 2.0.14.1-2.41.amzn1
pkg:rpm/amazonlinux/rubygems20-devel?arch=noarch&distro=amazonlinux-1 < 2.0.14.1-2.41.amzn1
pkg:rpm/amazonlinux/rubygem20-psych?arch=x86_64&distro=amazonlinux-1 < 2.0.0-2.41.amzn1
pkg:rpm/amazonlinux/rubygem20-psych?arch=i686&distro=amazonlinux-1 < 2.0.0-2.41.amzn1
pkg:rpm/amazonlinux/rubygem20-io-console?arch=x86_64&distro=amazonlinux-1 < 0.4.2-2.41.amzn1
pkg:rpm/amazonlinux/rubygem20-io-console?arch=i686&distro=amazonlinux-1 < 0.4.2-2.41.amzn1
pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=x86_64&distro=amazonlinux-1 < 1.2.0-2.41.amzn1
pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=i686&distro=amazonlinux-1 < 1.2.0-2.41.amzn1
pkg:rpm/amazonlinux/ruby20?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20-libs?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20-libs?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20-irb?arch=noarch&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20-doc?arch=noarch&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20-devel?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20-devel?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20-debuginfo?arch=x86_64&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
pkg:rpm/amazonlinux/ruby20-debuginfo?arch=i686&distro=amazonlinux-1 < 2.0.0.648-2.41.amzn1
ID
ALAS-2022-1638
Severity
medium
URL
https://alas.aws.amazon.com/ALAS-2022-1638.html
Published
2022-10-03T19:29:00
(23 months ago)
Modified
2022-10-10T20:41:00
(23 months ago)
Rights
Amazon Linux Security Team
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/amazonlinux/rubygems20?arch=noarch&distro=amazonlinux-1 amazonlinux rubygems20 < 2.0.14.1-2.41.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/rubygems20-devel?arch=noarch&distro=amazonlinux-1 amazonlinux rubygems20-devel < 2.0.14.1-2.41.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/rubygem20-psych?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-psych < 2.0.0-2.41.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-psych?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-psych < 2.0.0-2.41.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem20-io-console?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-io-console < 0.4.2-2.41.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-io-console?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-io-console < 0.4.2-2.41.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=x86_64&distro=amazonlinux-1 amazonlinux rubygem20-bigdecimal < 1.2.0-2.41.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/rubygem20-bigdecimal?arch=i686&distro=amazonlinux-1 amazonlinux rubygem20-bigdecimal < 1.2.0-2.41.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20 < 2.0.0.648-2.41.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20?arch=i686&distro=amazonlinux-1 amazonlinux ruby20 < 2.0.0.648-2.41.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-libs?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-libs < 2.0.0.648-2.41.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-libs?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-libs < 2.0.0.648-2.41.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-irb?arch=noarch&distro=amazonlinux-1 amazonlinux ruby20-irb < 2.0.0.648-2.41.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/ruby20-doc?arch=noarch&distro=amazonlinux-1 amazonlinux ruby20-doc < 2.0.0.648-2.41.amzn1 amazonlinux-1 noarch
Affected pkg:rpm/amazonlinux/ruby20-devel?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-devel < 2.0.0.648-2.41.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-devel?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-devel < 2.0.0.648-2.41.amzn1 amazonlinux-1 i686
Affected pkg:rpm/amazonlinux/ruby20-debuginfo?arch=x86_64&distro=amazonlinux-1 amazonlinux ruby20-debuginfo < 2.0.0.648-2.41.amzn1 amazonlinux-1 x86_64
Affected pkg:rpm/amazonlinux/ruby20-debuginfo?arch=i686&distro=amazonlinux-1 amazonlinux ruby20-debuginfo < 2.0.0.648-2.41.amzn1 amazonlinux-1 i686
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date