[RHSA-2018:0378] ruby security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module. (CVE-2017-17405)
A buffer underflow was found in ruby's sprintf function. An attacker, with ability to control its format string parameter, could send a specially crafted string that would disclose heap memory or crash the interpreter. (CVE-2017-0898)
It was found that rubygems did not sanitize gem names during installation of a given gem. A specially crafted gem could use this flaw to install files outside of the regular directory. (CVE-2017-0901)
A vulnerability was found where rubygems did not sanitize DNS responses when requesting the hostname of the rubygems server for a domain, via a _rubygems._tcp DNS SRV query. An attacker with the ability to manipulate DNS responses could direct the gem command towards a different domain. (CVE-2017-0902)
A vulnerability was found where the rubygems module was vulnerable to an unsafe YAML deserialization when inspecting a gem. Applications inspecting gem files without installing them can be tricked to execute arbitrary code in the context of the ruby interpreter. (CVE-2017-0903)
It was found that WEBrick did not sanitize all its log messages. If logs were printed in a terminal, an attacker could interact with the terminal via the use of escape sequences. (CVE-2017-10784)
It was found that the decode method of the OpenSSL::ASN1 module was vulnerable to buffer underrun. An attacker could pass a specially crafted string to the application in order to crash the ruby interpreter, causing a denial of service. (CVE-2017-14033)
A vulnerability was found where rubygems did not properly sanitize gems' specification text. A specially crafted gem could interact with the terminal via the use of escape sequences. (CVE-2017-0899)
It was found that rubygems could use an excessive amount of CPU while parsing a sufficiently long gem summary. A specially crafted gem from a gem repository could freeze gem commands attempting to parse its summary. (CVE-2017-0900)
A buffer overflow vulnerability was found in the JSON extension of ruby. An attacker with the ability to pass a specially crafted JSON input to the extension could use this flaw to expose the interpreter's heap memory. (CVE-2017-14064)
The "lazy_initialize" function in lib/resolv.rb did not properly process certain filenames. A remote attacker could possibly exploit this flaw to inject and execute arbitrary commands. (CVE-2017-17790)
- ID
- RHSA-2018:0378
- Severity
- important
- URL
- https://access.redhat.com/errata/RHSA-2018:0378
- Published
-
2018-02-28T00:00:00
(6 years ago) - Modified
-
2018-02-28T00:00:00
(6 years ago) - Rights
- Copyright 2018 Red Hat, Inc.
- Other Advisories
-
- ALAS-2017-906
- ALAS-2017-915
- ALAS-2018-978
- ALAS-2018-983
- ALAS2-2018-983
- ALPINE:CVE-2017-0898
- ALPINE:CVE-2017-0899
- ALPINE:CVE-2017-0900
- ALPINE:CVE-2017-0901
- ALPINE:CVE-2017-0902
- ALPINE:CVE-2017-10784
- ALPINE:CVE-2017-14033
- ALPINE:CVE-2017-14064
- ALPINE:CVE-2017-17405
- DSA-3966-1
- DSA-4031-1
- DSA-4259-1
- ELSA-2018-0378
- FEDORA-2017-20214ad330
- FEDORA-2017-4166994614
- FEDORA-2017-6e6f4f95e6
- FEDORA-2017-81cf93b7c2
- FEDORA-2017-e136d63c99
- FEDORA-2018-0db545e976
- FEDORA-2018-1fffa787e7
- FEDORA-2018-40ed78700c
- FEDORA-2018-75e780a7c2
- FREEBSD:2C8BD00D-ADA2-11E7-82AF-8DBFF7D75206
- FREEBSD:95B01379-9D52-11E7-A25C-471BAFC3262F
- FREEBSD:DD644964-E10E-11E7-8097-0800271D4B9C
- GLSA-201710-01
- GLSA-201710-18
- GLSA-201802-05
- RUBYSEC:OPENSSL-2017-14033
- RUBYSEC:RUBYGEMS-UPDATE-2017-0899
- RUBYSEC:RUBYGEMS-UPDATE-2017-0900
- RUBYSEC:RUBYGEMS-UPDATE-2017-0901
- RUBYSEC:RUBYGEMS-UPDATE-2017-0902
- RUBYSEC:RUBYGEMS-UPDATE-2017-0903
- RUBYSEC:WEBRICK-2017-10784
- SSA:2017-261-03
- SSA:2017-353-01
- SUSE-SU-2020:1570-1
- USN-3439-1
- USN-3515-1
- USN-3528-1
- USN-3553-1
- USN-3685-1
- USN-3685-2
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/redhat/rubygems?distro=redhat-7.4 | redhat | rubygems | < 2.0.14.1-33.el7_4 | redhat-7.4 | ||
Affected | pkg:rpm/redhat/rubygems-devel?distro=redhat-7.4 | redhat | rubygems-devel | < 2.0.14.1-33.el7_4 | redhat-7.4 | ||
Affected | pkg:rpm/redhat/rubygem-rdoc?distro=redhat-7.4 | redhat | rubygem-rdoc | < 4.0.0-33.el7_4 | redhat-7.4 | ||
Affected | pkg:rpm/redhat/rubygem-rake?distro=redhat-7.4 | redhat | rubygem-rake | < 0.9.6-33.el7_4 | redhat-7.4 | ||
Affected | pkg:rpm/redhat/rubygem-psych?arch=x86_64&distro=redhat-7.4 | redhat | rubygem-psych | < 2.0.0-33.el7_4 | redhat-7.4 | x86_64 | |
Affected | pkg:rpm/redhat/rubygem-psych?arch=s390x&distro=redhat-7.4 | redhat | rubygem-psych | < 2.0.0-33.el7_4 | redhat-7.4 | s390x | |
Affected | pkg:rpm/redhat/rubygem-psych?arch=ppc64le&distro=redhat-7.4 | redhat | rubygem-psych | < 2.0.0-33.el7_4 | redhat-7.4 | ppc64le | |
Affected | pkg:rpm/redhat/rubygem-psych?arch=ppc64&distro=redhat-7.4 | redhat | rubygem-psych | < 2.0.0-33.el7_4 | redhat-7.4 | ppc64 | |
Affected | pkg:rpm/redhat/rubygem-psych?arch=aarch64&distro=redhat-7.4 | redhat | rubygem-psych | < 2.0.0-33.el7_4 | redhat-7.4 | aarch64 | |
Affected | pkg:rpm/redhat/rubygem-minitest?distro=redhat-7.4 | redhat | rubygem-minitest | < 4.3.2-33.el7_4 | redhat-7.4 | ||
Affected | pkg:rpm/redhat/rubygem-json?arch=x86_64&distro=redhat-7.4 | redhat | rubygem-json | < 1.7.7-33.el7_4 | redhat-7.4 | x86_64 | |
Affected | pkg:rpm/redhat/rubygem-json?arch=s390x&distro=redhat-7.4 | redhat | rubygem-json | < 1.7.7-33.el7_4 | redhat-7.4 | s390x | |
Affected | pkg:rpm/redhat/rubygem-json?arch=ppc64le&distro=redhat-7.4 | redhat | rubygem-json | < 1.7.7-33.el7_4 | redhat-7.4 | ppc64le | |
Affected | pkg:rpm/redhat/rubygem-json?arch=ppc64&distro=redhat-7.4 | redhat | rubygem-json | < 1.7.7-33.el7_4 | redhat-7.4 | ppc64 | |
Affected | pkg:rpm/redhat/rubygem-json?arch=aarch64&distro=redhat-7.4 | redhat | rubygem-json | < 1.7.7-33.el7_4 | redhat-7.4 | aarch64 | |
Affected | pkg:rpm/redhat/rubygem-io-console?arch=x86_64&distro=redhat-7.4 | redhat | rubygem-io-console | < 0.4.2-33.el7_4 | redhat-7.4 | x86_64 | |
Affected | pkg:rpm/redhat/rubygem-io-console?arch=s390x&distro=redhat-7.4 | redhat | rubygem-io-console | < 0.4.2-33.el7_4 | redhat-7.4 | s390x | |
Affected | pkg:rpm/redhat/rubygem-io-console?arch=ppc64le&distro=redhat-7.4 | redhat | rubygem-io-console | < 0.4.2-33.el7_4 | redhat-7.4 | ppc64le | |
Affected | pkg:rpm/redhat/rubygem-io-console?arch=ppc64&distro=redhat-7.4 | redhat | rubygem-io-console | < 0.4.2-33.el7_4 | redhat-7.4 | ppc64 | |
Affected | pkg:rpm/redhat/rubygem-io-console?arch=aarch64&distro=redhat-7.4 | redhat | rubygem-io-console | < 0.4.2-33.el7_4 | redhat-7.4 | aarch64 | |
Affected | pkg:rpm/redhat/rubygem-bigdecimal?arch=x86_64&distro=redhat-7.4 | redhat | rubygem-bigdecimal | < 1.2.0-33.el7_4 | redhat-7.4 | x86_64 | |
Affected | pkg:rpm/redhat/rubygem-bigdecimal?arch=s390x&distro=redhat-7.4 | redhat | rubygem-bigdecimal | < 1.2.0-33.el7_4 | redhat-7.4 | s390x | |
Affected | pkg:rpm/redhat/rubygem-bigdecimal?arch=ppc64le&distro=redhat-7.4 | redhat | rubygem-bigdecimal | < 1.2.0-33.el7_4 | redhat-7.4 | ppc64le | |
Affected | pkg:rpm/redhat/rubygem-bigdecimal?arch=ppc64&distro=redhat-7.4 | redhat | rubygem-bigdecimal | < 1.2.0-33.el7_4 | redhat-7.4 | ppc64 | |
Affected | pkg:rpm/redhat/rubygem-bigdecimal?arch=aarch64&distro=redhat-7.4 | redhat | rubygem-bigdecimal | < 1.2.0-33.el7_4 | redhat-7.4 | aarch64 | |
Affected | pkg:rpm/redhat/ruby?arch=x86_64&distro=redhat-7.4 | redhat | ruby | < 2.0.0.648-33.el7_4 | redhat-7.4 | x86_64 | |
Affected | pkg:rpm/redhat/ruby?arch=s390x&distro=redhat-7.4 | redhat | ruby | < 2.0.0.648-33.el7_4 | redhat-7.4 | s390x | |
Affected | pkg:rpm/redhat/ruby?arch=ppc64le&distro=redhat-7.4 | redhat | ruby | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc64le | |
Affected | pkg:rpm/redhat/ruby?arch=ppc64&distro=redhat-7.4 | redhat | ruby | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc64 | |
Affected | pkg:rpm/redhat/ruby?arch=aarch64&distro=redhat-7.4 | redhat | ruby | < 2.0.0.648-33.el7_4 | redhat-7.4 | aarch64 | |
Affected | pkg:rpm/redhat/ruby-tcltk?arch=x86_64&distro=redhat-7.4 | redhat | ruby-tcltk | < 2.0.0.648-33.el7_4 | redhat-7.4 | x86_64 | |
Affected | pkg:rpm/redhat/ruby-tcltk?arch=s390x&distro=redhat-7.4 | redhat | ruby-tcltk | < 2.0.0.648-33.el7_4 | redhat-7.4 | s390x | |
Affected | pkg:rpm/redhat/ruby-tcltk?arch=ppc64le&distro=redhat-7.4 | redhat | ruby-tcltk | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc64le | |
Affected | pkg:rpm/redhat/ruby-tcltk?arch=ppc64&distro=redhat-7.4 | redhat | ruby-tcltk | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc64 | |
Affected | pkg:rpm/redhat/ruby-tcltk?arch=aarch64&distro=redhat-7.4 | redhat | ruby-tcltk | < 2.0.0.648-33.el7_4 | redhat-7.4 | aarch64 | |
Affected | pkg:rpm/redhat/ruby-libs?arch=x86_64&distro=redhat-7.4 | redhat | ruby-libs | < 2.0.0.648-33.el7_4 | redhat-7.4 | x86_64 | |
Affected | pkg:rpm/redhat/ruby-libs?arch=s390x&distro=redhat-7.4 | redhat | ruby-libs | < 2.0.0.648-33.el7_4 | redhat-7.4 | s390x | |
Affected | pkg:rpm/redhat/ruby-libs?arch=s390&distro=redhat-7.4 | redhat | ruby-libs | < 2.0.0.648-33.el7_4 | redhat-7.4 | s390 | |
Affected | pkg:rpm/redhat/ruby-libs?arch=ppc64le&distro=redhat-7.4 | redhat | ruby-libs | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc64le | |
Affected | pkg:rpm/redhat/ruby-libs?arch=ppc64&distro=redhat-7.4 | redhat | ruby-libs | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc64 | |
Affected | pkg:rpm/redhat/ruby-libs?arch=ppc&distro=redhat-7.4 | redhat | ruby-libs | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc | |
Affected | pkg:rpm/redhat/ruby-libs?arch=i686&distro=redhat-7.4 | redhat | ruby-libs | < 2.0.0.648-33.el7_4 | redhat-7.4 | i686 | |
Affected | pkg:rpm/redhat/ruby-libs?arch=aarch64&distro=redhat-7.4 | redhat | ruby-libs | < 2.0.0.648-33.el7_4 | redhat-7.4 | aarch64 | |
Affected | pkg:rpm/redhat/ruby-irb?distro=redhat-7.4 | redhat | ruby-irb | < 2.0.0.648-33.el7_4 | redhat-7.4 | ||
Affected | pkg:rpm/redhat/ruby-doc?distro=redhat-7.4 | redhat | ruby-doc | < 2.0.0.648-33.el7_4 | redhat-7.4 | ||
Affected | pkg:rpm/redhat/ruby-devel?arch=x86_64&distro=redhat-7.4 | redhat | ruby-devel | < 2.0.0.648-33.el7_4 | redhat-7.4 | x86_64 | |
Affected | pkg:rpm/redhat/ruby-devel?arch=s390x&distro=redhat-7.4 | redhat | ruby-devel | < 2.0.0.648-33.el7_4 | redhat-7.4 | s390x | |
Affected | pkg:rpm/redhat/ruby-devel?arch=ppc64le&distro=redhat-7.4 | redhat | ruby-devel | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc64le | |
Affected | pkg:rpm/redhat/ruby-devel?arch=ppc64&distro=redhat-7.4 | redhat | ruby-devel | < 2.0.0.648-33.el7_4 | redhat-7.4 | ppc64 | |
Affected | pkg:rpm/redhat/ruby-devel?arch=aarch64&distro=redhat-7.4 | redhat | ruby-devel | < 2.0.0.648-33.el7_4 | redhat-7.4 | aarch64 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |