- Issued:
- 2024-05-30
- Updated:
- 2024-05-30
RHSA-2024:3500 - Moderate: ruby:3.0 security update
Synopsis
Moderate: ruby:3.0 security update
Type/Severity
Security Advisory Moderate
Topic
An update for the ruby:3.0 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
-
ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
-
ruby: ReDoS vulnerability in URI (CVE-2023-28755)
-
ruby: ReDoS vulnerability in Time (CVE-2023-28756)
-
ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
-
ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
-
ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Solution
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat Enterprise Linux for x86_64 | 8 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Life Cycle | 8.10 | x86_64 |
| Red Hat Enterprise Linux for Power, little endian | 8 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle | 8.10 | ppc64le |
| Red Hat Enterprise Linux for IBM z Systems | 8 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle | 8.10 | s390x |
| Red Hat Enterprise Linux for ARM 64 | 8 | aarch64 |
| Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle | 8.10 | aarch64 |
Updated Packages
- ruby-devel-3.0.7-143.module+el8.10.0+21858+d19f3934.i686.rpm
- ruby-libs-3.0.7-143.module+el8.10.0+21858+d19f3934.i686.rpm
- ruby-libs-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.i686.rpm
- rubygem-bundler-2.2.33-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-rake-13.0.3-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-bigdecimal-3.0.0-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-mysql2-debugsource-0.5.3-2.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-pg-doc-1.2.3-1.module+el8.10.0+21858+d19f3934.noarch.rpm
- ruby-doc-3.0.7-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-mysql2-doc-0.5.3-2.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-mysql2-0.5.3-2.module+el8.10.0+21858+d19f3934.src.rpm
- rubygem-power_assert-1.2.1-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- ruby-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.i686.rpm
- ruby-libs-3.0.7-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-psych-debuginfo-3.3.2-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-mysql2-debuginfo-0.5.3-2.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-abrt-0.4.0-1.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-typeprof-0.15.2-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-pg-1.2.3-1.module+el8.10.0+21858+d19f3934.src.rpm
- rubygem-json-debuginfo-2.5.1-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-minitest-5.14.2-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-rdoc-6.3.4.1-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-rss-0.2.9-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- ruby-libs-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-io-console-debuginfo-0.5.7-143.module+el8.10.0+21858+d19f3934.i686.rpm
- ruby-debugsource-3.0.7-143.module+el8.10.0+21858+d19f3934.i686.rpm
- rubygem-irb-1.3.5-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-bigdecimal-debuginfo-3.0.0-143.module+el8.10.0+21858+d19f3934.i686.rpm
- rubygem-psych-3.3.2-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-io-console-0.5.7-143.module+el8.10.0+21858+d19f3934.i686.rpm
- rubygems-devel-3.2.33-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-rexml-3.2.5-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-abrt-0.4.0-1.module+el8.10.0+21858+d19f3934.src.rpm
- rubygem-pg-1.2.3-1.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-bigdecimal-3.0.0-143.module+el8.10.0+21858+d19f3934.i686.rpm
- rubygem-psych-debuginfo-3.3.2-143.module+el8.10.0+21858+d19f3934.i686.rpm
- rubygem-test-unit-3.3.7-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-pg-debugsource-1.2.3-1.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-pg-debuginfo-1.2.3-1.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-bigdecimal-debuginfo-3.0.0-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- ruby-default-gems-3.0.7-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-abrt-doc-0.4.0-1.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-rbs-1.4.0-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-io-console-0.5.7-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- ruby-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- ruby-devel-3.0.7-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-io-console-debuginfo-0.5.7-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-mysql2-0.5.3-2.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-psych-3.3.2-143.module+el8.10.0+21858+d19f3934.i686.rpm
- ruby-debugsource-3.0.7-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-json-debuginfo-2.5.1-143.module+el8.10.0+21858+d19f3934.i686.rpm
- ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.src.rpm
- ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.i686.rpm
- rubygem-json-2.5.1-143.module+el8.10.0+21858+d19f3934.i686.rpm
- rubygems-3.2.33-143.module+el8.10.0+21858+d19f3934.noarch.rpm
- rubygem-json-2.5.1-143.module+el8.10.0+21858+d19f3934.x86_64.rpm
- rubygem-psych-3.3.2-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-pg-debugsource-1.2.3-1.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-mysql2-0.5.3-2.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-psych-debuginfo-3.3.2-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- ruby-devel-3.0.7-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- ruby-libs-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-bigdecimal-3.0.0-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- ruby-libs-3.0.7-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-mysql2-debuginfo-0.5.3-2.module+el8.10.0+21858+d19f3934.s390x.rpm
- ruby-debugsource-3.0.7-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- ruby-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-json-2.5.1-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-json-debuginfo-2.5.1-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-bigdecimal-debuginfo-3.0.0-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-io-console-debuginfo-0.5.7-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-pg-1.2.3-1.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-pg-debuginfo-1.2.3-1.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-io-console-0.5.7-143.module+el8.10.0+21858+d19f3934.s390x.rpm
- rubygem-mysql2-debugsource-0.5.3-2.module+el8.10.0+21858+d19f3934.s390x.rpm
- ruby-libs-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- ruby-devel-3.0.7-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-psych-3.3.2-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- ruby-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-mysql2-debugsource-0.5.3-2.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-pg-1.2.3-1.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-psych-debuginfo-3.3.2-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-mysql2-debuginfo-0.5.3-2.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-bigdecimal-3.0.0-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-json-2.5.1-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-pg-debugsource-1.2.3-1.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-io-console-debuginfo-0.5.7-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-pg-debuginfo-1.2.3-1.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- ruby-debugsource-3.0.7-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-json-debuginfo-2.5.1-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-io-console-0.5.7-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-bigdecimal-debuginfo-3.0.0-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- ruby-libs-3.0.7-143.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-mysql2-0.5.3-2.module+el8.10.0+21858+d19f3934.ppc64le.rpm
- rubygem-bigdecimal-3.0.0-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-mysql2-0.5.3-2.module+el8.10.0+21858+d19f3934.aarch64.rpm
- ruby-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-json-2.5.1-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-pg-debuginfo-1.2.3-1.module+el8.10.0+21858+d19f3934.aarch64.rpm
- ruby-libs-debuginfo-3.0.7-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-io-console-debuginfo-0.5.7-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-io-console-0.5.7-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-mysql2-debugsource-0.5.3-2.module+el8.10.0+21858+d19f3934.aarch64.rpm
- ruby-libs-3.0.7-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-psych-3.3.2-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-json-debuginfo-2.5.1-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-mysql2-debuginfo-0.5.3-2.module+el8.10.0+21858+d19f3934.aarch64.rpm
- ruby-debugsource-3.0.7-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-bigdecimal-debuginfo-3.0.0-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- ruby-devel-3.0.7-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-pg-1.2.3-1.module+el8.10.0+21858+d19f3934.aarch64.rpm
- ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-pg-debugsource-1.2.3-1.module+el8.10.0+21858+d19f3934.aarch64.rpm
- rubygem-psych-debuginfo-3.3.2-143.module+el8.10.0+21858+d19f3934.aarch64.rpm
Fixes
- This content is not included.BZ - 2149706
- This content is not included.BZ - 2184059
- This content is not included.BZ - 2184061
- This content is not included.BZ - 2270749
- This content is not included.BZ - 2270750
- This content is not included.BZ - 2276810
CVEs
References
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.