Ubuntu Security Notice 4882-1 - It was discovered that the Ruby JSON gem incorrectly handled certain JSON files. If a user or automated system were tricked into parsing a specially crafted JSON file, a remote attacker could use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that Ruby incorrectly handled certain socket memory operations. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Various other issues were also addressed.
283a88217feec850de336cca9e09f282e9c9a4430901603c938294b461152b82
==========================================================================
Ubuntu Security Notice USN-4882-1
March 18, 2021
ruby2.3, ruby2.5, ruby2.7 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Ruby.
Software Description:
- ruby2.7: Object-oriented scripting language
- ruby2.5: Object-oriented scripting language
- ruby2.3: Object-oriented scripting language
Details:
It was discovered that the Ruby JSON gem incorrectly handled certain JSON
files. If a user or automated system were tricked into parsing a specially
crafted JSON file, a remote attacker could use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-10663)
It was discovered that Ruby incorrectly handled certain socket memory
operations. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2020-10933)
It was discovered that Ruby incorrectly handled certain transfer-encoding
headers when using Webrick. A remote attacker could possibly use this issue
to bypass a reverse proxy. (CVE-2020-25613)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
libruby2.7 2.7.1-3ubuntu1.2
ruby2.7 2.7.1-3ubuntu1.2
Ubuntu 20.04 LTS:
libruby2.7 2.7.0-5ubuntu1.3
ruby2.7 2.7.0-5ubuntu1.3
Ubuntu 18.04 LTS:
libruby2.5 2.5.1-1ubuntu1.8
ruby2.5 2.5.1-1ubuntu1.8
Ubuntu 16.04 LTS:
libruby2.3 2.3.1-2~ubuntu16.04.15
ruby2.3 2.3.1-2~ubuntu16.04.15
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-4882-1
CVE-2020-10663, CVE-2020-10933, CVE-2020-25613
Package Information:
https://launchpad.net/ubuntu/+source/ruby2.7/2.7.1-3ubuntu1.2
https://launchpad.net/ubuntu/+source/ruby2.7/2.7.0-5ubuntu1.3
https://launchpad.net/ubuntu/+source/ruby2.5/2.5.1-1ubuntu1.8
https://launchpad.net/ubuntu/+source/ruby2.3/2.3.1-2~ubuntu16.04.15