1. Home
  2. Security Advisories
  3. Ubuntu
  4. USN-5806-2

[USN-5806-2] Ruby vulnerability

Severity High
Affected Packages 12
CVEs 1
Info Packages Vulnerabilities

Ruby could allow for internet traffic to be modified if a vulnerable application processed malicious user input.

USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem
for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.10.

Original advisory details:

Hiroshi Tokumaru discovered that Ruby did not properly handle certain
user input for applications which generate HTTP responses using cgi gem.
An attacker could possibly use this issue to maliciously modify the
response a user would receive from a vulnerable application.

Package Affected Version
pkg:deb/ubuntu/ruby3.0?distro=kinetic < 3.0.4-7ubuntu0.1
pkg:deb/ubuntu/ruby3.0?distro=jammy < 3.0.2-7ubuntu2.3
pkg:deb/ubuntu/ruby3.0-doc?distro=kinetic < 3.0.4-7ubuntu0.1
pkg:deb/ubuntu/ruby3.0-doc?distro=jammy < 3.0.2-7ubuntu2.3
pkg:deb/ubuntu/ruby3.0-dev?distro=kinetic < 3.0.4-7ubuntu0.1
pkg:deb/ubuntu/ruby3.0-dev?distro=jammy < 3.0.2-7ubuntu2.3
pkg:deb/ubuntu/ruby2.5?distro=bionic < 2.5.1-1ubuntu1.13
pkg:deb/ubuntu/ruby2.5-doc?distro=bionic < 2.5.1-1ubuntu1.13
pkg:deb/ubuntu/ruby2.5-dev?distro=bionic < 2.5.1-1ubuntu1.13
pkg:deb/ubuntu/libruby3.0?distro=kinetic < 3.0.4-7ubuntu0.1
pkg:deb/ubuntu/libruby3.0?distro=jammy < 3.0.2-7ubuntu2.3
pkg:deb/ubuntu/libruby2.5?distro=bionic < 2.5.1-1ubuntu1.13
ID
USN-5806-2
Severity
high
Severity from
CVE-2021-33621
URL
https://ubuntu.com/security/notices/USN-5806-2
Published
2023-01-23T14:41:40
(19 months ago)
Modified
2023-01-23T14:41:40
(19 months ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:deb/ubuntu/ruby3.0?distro=kinetic ubuntu ruby3.0 < 3.0.4-7ubuntu0.1 kinetic
Affected pkg:deb/ubuntu/ruby3.0?distro=jammy ubuntu ruby3.0 < 3.0.2-7ubuntu2.3 jammy
Affected pkg:deb/ubuntu/ruby3.0-doc?distro=kinetic ubuntu ruby3.0-doc < 3.0.4-7ubuntu0.1 kinetic
Affected pkg:deb/ubuntu/ruby3.0-doc?distro=jammy ubuntu ruby3.0-doc < 3.0.2-7ubuntu2.3 jammy
Affected pkg:deb/ubuntu/ruby3.0-dev?distro=kinetic ubuntu ruby3.0-dev < 3.0.4-7ubuntu0.1 kinetic
Affected pkg:deb/ubuntu/ruby3.0-dev?distro=jammy ubuntu ruby3.0-dev < 3.0.2-7ubuntu2.3 jammy
Affected pkg:deb/ubuntu/ruby2.5?distro=bionic ubuntu ruby2.5 < 2.5.1-1ubuntu1.13 bionic
Affected pkg:deb/ubuntu/ruby2.5-doc?distro=bionic ubuntu ruby2.5-doc < 2.5.1-1ubuntu1.13 bionic
Affected pkg:deb/ubuntu/ruby2.5-dev?distro=bionic ubuntu ruby2.5-dev < 2.5.1-1ubuntu1.13 bionic
Affected pkg:deb/ubuntu/libruby3.0?distro=kinetic ubuntu libruby3.0 < 3.0.4-7ubuntu0.1 kinetic
Affected pkg:deb/ubuntu/libruby3.0?distro=jammy ubuntu libruby3.0 < 3.0.2-7ubuntu2.3 jammy
Affected pkg:deb/ubuntu/libruby2.5?distro=bionic ubuntu libruby2.5 < 2.5.1-1ubuntu1.13 bionic
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date