[ALAS2-2019-1143] Amazon Linux 2 2017.12 - ALAS2-2019-1143: important priority package update for ruby
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:
CVE-2018-16395:
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
1643086:
CVE-2018-16395 ruby: OpenSSL::X509::Name equality check does not work correctly
- ID
- ALAS2-2019-1143
- Severity
- important
- URL
- https://alas.aws.amazon.com/AL2/ALAS-2019-1143.html
- Published
-
2019-01-07T22:05:00
(5 years ago) - Modified
-
2019-01-09T01:10:00
(5 years ago) - Rights
- Amazon Linux Security Team
- Other Advisories
-
- ALAS-2018-1113
- ALPINE:CVE-2018-16395
- DSA-4332-1
- ELSA-2018-3738
- FEDORA-2018-190ecd2ef8
- FEDORA-2018-319b9d0f68
- FEDORA-2018-6070bcf454
- FREEBSD:AFC60484-0652-440E-B01A-5EF814747F06
- MS:CVE-2018-16395
- openSUSE-SU-2019:1771-1
- RHSA-2018:3738
- RUBYSEC:OPENSSL-2018-16395
- SUSE-SU-2019:1804-1
- SUSE-SU-2020:1570-1
- USN-3808-1
Source | # ID | Name | URL |
---|---|---|---|
CVE | CVE-2018-16395 | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16395 |
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/amazonlinux/rubygems?arch=noarch&distro=amazonlinux-2 | amazonlinux | rubygems | < 2.0.14.1-34.amzn2.0.1 | amazonlinux-2 | noarch | |
Affected | pkg:rpm/amazonlinux/rubygems-devel?arch=noarch&distro=amazonlinux-2 | amazonlinux | rubygems-devel | < 2.0.14.1-34.amzn2.0.1 | amazonlinux-2 | noarch | |
Affected | pkg:rpm/amazonlinux/rubygem-rdoc?arch=noarch&distro=amazonlinux-2 | amazonlinux | rubygem-rdoc | < 4.0.0-34.amzn2.0.1 | amazonlinux-2 | noarch | |
Affected | pkg:rpm/amazonlinux/rubygem-rake?arch=noarch&distro=amazonlinux-2 | amazonlinux | rubygem-rake | < 0.9.6-34.amzn2.0.1 | amazonlinux-2 | noarch | |
Affected | pkg:rpm/amazonlinux/rubygem-psych?arch=x86_64&distro=amazonlinux-2 | amazonlinux | rubygem-psych | < 2.0.0-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/rubygem-psych?arch=i686&distro=amazonlinux-2 | amazonlinux | rubygem-psych | < 2.0.0-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/rubygem-psych?arch=aarch64&distro=amazonlinux-2 | amazonlinux | rubygem-psych | < 2.0.0-34.amzn2.0.1 | amazonlinux-2 | aarch64 | |
Affected | pkg:rpm/amazonlinux/rubygem-minitest?arch=noarch&distro=amazonlinux-2 | amazonlinux | rubygem-minitest | < 4.3.2-34.amzn2.0.1 | amazonlinux-2 | noarch | |
Affected | pkg:rpm/amazonlinux/rubygem-json?arch=x86_64&distro=amazonlinux-2 | amazonlinux | rubygem-json | < 1.7.7-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/rubygem-json?arch=i686&distro=amazonlinux-2 | amazonlinux | rubygem-json | < 1.7.7-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/rubygem-json?arch=aarch64&distro=amazonlinux-2 | amazonlinux | rubygem-json | < 1.7.7-34.amzn2.0.1 | amazonlinux-2 | aarch64 | |
Affected | pkg:rpm/amazonlinux/rubygem-io-console?arch=x86_64&distro=amazonlinux-2 | amazonlinux | rubygem-io-console | < 0.4.2-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/rubygem-io-console?arch=i686&distro=amazonlinux-2 | amazonlinux | rubygem-io-console | < 0.4.2-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/rubygem-io-console?arch=aarch64&distro=amazonlinux-2 | amazonlinux | rubygem-io-console | < 0.4.2-34.amzn2.0.1 | amazonlinux-2 | aarch64 | |
Affected | pkg:rpm/amazonlinux/rubygem-bigdecimal?arch=x86_64&distro=amazonlinux-2 | amazonlinux | rubygem-bigdecimal | < 1.2.0-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/rubygem-bigdecimal?arch=i686&distro=amazonlinux-2 | amazonlinux | rubygem-bigdecimal | < 1.2.0-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/rubygem-bigdecimal?arch=aarch64&distro=amazonlinux-2 | amazonlinux | rubygem-bigdecimal | < 1.2.0-34.amzn2.0.1 | amazonlinux-2 | aarch64 | |
Affected | pkg:rpm/amazonlinux/ruby?arch=x86_64&distro=amazonlinux-2 | amazonlinux | ruby | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/ruby?arch=i686&distro=amazonlinux-2 | amazonlinux | ruby | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/ruby?arch=aarch64&distro=amazonlinux-2 | amazonlinux | ruby | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | aarch64 | |
Affected | pkg:rpm/amazonlinux/ruby-tcltk?arch=x86_64&distro=amazonlinux-2 | amazonlinux | ruby-tcltk | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/ruby-tcltk?arch=i686&distro=amazonlinux-2 | amazonlinux | ruby-tcltk | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/ruby-tcltk?arch=aarch64&distro=amazonlinux-2 | amazonlinux | ruby-tcltk | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | aarch64 | |
Affected | pkg:rpm/amazonlinux/ruby-libs?arch=x86_64&distro=amazonlinux-2 | amazonlinux | ruby-libs | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/ruby-libs?arch=i686&distro=amazonlinux-2 | amazonlinux | ruby-libs | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/ruby-libs?arch=aarch64&distro=amazonlinux-2 | amazonlinux | ruby-libs | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | aarch64 | |
Affected | pkg:rpm/amazonlinux/ruby-irb?arch=noarch&distro=amazonlinux-2 | amazonlinux | ruby-irb | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | noarch | |
Affected | pkg:rpm/amazonlinux/ruby-doc?arch=noarch&distro=amazonlinux-2 | amazonlinux | ruby-doc | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | noarch | |
Affected | pkg:rpm/amazonlinux/ruby-devel?arch=x86_64&distro=amazonlinux-2 | amazonlinux | ruby-devel | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/ruby-devel?arch=i686&distro=amazonlinux-2 | amazonlinux | ruby-devel | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/ruby-devel?arch=aarch64&distro=amazonlinux-2 | amazonlinux | ruby-devel | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | aarch64 | |
Affected | pkg:rpm/amazonlinux/ruby-debuginfo?arch=x86_64&distro=amazonlinux-2 | amazonlinux | ruby-debuginfo | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | x86_64 | |
Affected | pkg:rpm/amazonlinux/ruby-debuginfo?arch=i686&distro=amazonlinux-2 | amazonlinux | ruby-debuginfo | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | i686 | |
Affected | pkg:rpm/amazonlinux/ruby-debuginfo?arch=aarch64&distro=amazonlinux-2 | amazonlinux | ruby-debuginfo | < 2.0.0.648-34.amzn2.0.1 | amazonlinux-2 | aarch64 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |