[USN-5806-3] Ruby vulnerability

Severity High

Affected Packages 4

CVEs 1

Ruby could allow for internet traffic to be modified if a vulnerable application processed malicious user input.

USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem
for Ubuntu 20.04 LTS.

Original advisory details:

Hiroshi Tokumaru discovered that Ruby did not properly handle certain
user input for applications which generate HTTP responses using cgi gem.
An attacker could possibly use this issue to maliciously modify the
response a user would receive from a vulnerable application.

Package	Affected Version
pkg:deb/ubuntu/ruby2.7?distro=focal	< 2.7.0-5ubuntu1.8
pkg:deb/ubuntu/ruby2.7-doc?distro=focal	< 2.7.0-5ubuntu1.8
pkg:deb/ubuntu/ruby2.7-dev?distro=focal	< 2.7.0-5ubuntu1.8
pkg:deb/ubuntu/libruby2.7?distro=focal	< 2.7.0-5ubuntu1.8

ID

USN-5806-3

Severity

high

Severity from

CVE-2021-33621

URL

https://ubuntu.com/security/notices/USN-5806-3

Published

2023-03-20T17:24:47
(17 months ago)

Modified

2023-03-20T17:24:47
(17 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/ruby2.7?distro=focal	ubuntu	ruby2.7	< 2.7.0-5ubuntu1.8	focal
Affected	pkg:deb/ubuntu/ruby2.7-doc?distro=focal	ubuntu	ruby2.7-doc	< 2.7.0-5ubuntu1.8	focal
Affected	pkg:deb/ubuntu/ruby2.7-dev?distro=focal	ubuntu	ruby2.7-dev	< 2.7.0-5ubuntu1.8	focal
Affected	pkg:deb/ubuntu/libruby2.7?distro=focal	ubuntu	libruby2.7	< 2.7.0-5ubuntu1.8	focal

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date