-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-ruby27-ruby security, bug fix, and enhancement update Advisory ID: RHSA-2022:6856-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2022:6856 Issue date: 2022-10-11 CVE Names: CVE-2021-41816 CVE-2021-41817 CVE-2021-41819 CVE-2022-28739 ==================================================================== 1. Summary: An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: rh-ruby27-ruby (2.7.6). (BZ#2128631) Security Fix(es): * ruby: buffer overflow in CGI.escape_html (CVE-2021-41816) * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817) * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819) * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2025104 - CVE-2021-41817 ruby: Regular expression denial of service vulnerability of Date parsing methods 2026752 - CVE-2021-41816 ruby: buffer overflow in CGI.escape_html 2026757 - CVE-2021-41819 ruby: Cookie prefix spoofing in CGI::Cookie.parse 2075687 - CVE-2022-28739 Ruby: Buffer overrun in String-to-Float conversion 2128631 - rh-ruby27-ruby: Rebase to the latest Ruby 2.7 release [rhscl-3] [rhscl-3.8.z] 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-ruby27-ruby-2.7.6-131.el7.src.rpm noarch: rh-ruby27-ruby-doc-2.7.6-131.el7.noarch.rpm rh-ruby27-rubygem-bundler-2.2.24-131.el7.noarch.rpm rh-ruby27-rubygem-did_you_mean-1.4.0-131.el7.noarch.rpm rh-ruby27-rubygem-irb-1.2.6-131.el7.noarch.rpm rh-ruby27-rubygem-minitest-5.13.0-131.el7.noarch.rpm rh-ruby27-rubygem-net-telnet-0.2.0-131.el7.noarch.rpm rh-ruby27-rubygem-power_assert-1.1.7-131.el7.noarch.rpm rh-ruby27-rubygem-rake-13.0.1-131.el7.noarch.rpm rh-ruby27-rubygem-rdoc-6.2.1.1-131.el7.noarch.rpm rh-ruby27-rubygem-test-unit-3.3.4-131.el7.noarch.rpm rh-ruby27-rubygem-xmlrpc-0.3.0-131.el7.noarch.rpm rh-ruby27-rubygems-3.1.6-131.el7.noarch.rpm rh-ruby27-rubygems-devel-3.1.6-131.el7.noarch.rpm ppc64le: rh-ruby27-ruby-2.7.6-131.el7.ppc64le.rpm rh-ruby27-ruby-debuginfo-2.7.6-131.el7.ppc64le.rpm rh-ruby27-ruby-devel-2.7.6-131.el7.ppc64le.rpm rh-ruby27-ruby-libs-2.7.6-131.el7.ppc64le.rpm rh-ruby27-rubygem-bigdecimal-2.0.0-131.el7.ppc64le.rpm rh-ruby27-rubygem-io-console-0.5.6-131.el7.ppc64le.rpm rh-ruby27-rubygem-json-2.3.0-131.el7.ppc64le.rpm rh-ruby27-rubygem-openssl-2.1.3-131.el7.ppc64le.rpm rh-ruby27-rubygem-psych-3.1.0-131.el7.ppc64le.rpm rh-ruby27-rubygem-racc-1.4.16-131.el7.ppc64le.rpm s390x: rh-ruby27-ruby-2.7.6-131.el7.s390x.rpm rh-ruby27-ruby-debuginfo-2.7.6-131.el7.s390x.rpm rh-ruby27-ruby-devel-2.7.6-131.el7.s390x.rpm rh-ruby27-ruby-libs-2.7.6-131.el7.s390x.rpm rh-ruby27-rubygem-bigdecimal-2.0.0-131.el7.s390x.rpm rh-ruby27-rubygem-io-console-0.5.6-131.el7.s390x.rpm rh-ruby27-rubygem-json-2.3.0-131.el7.s390x.rpm rh-ruby27-rubygem-openssl-2.1.3-131.el7.s390x.rpm rh-ruby27-rubygem-psych-3.1.0-131.el7.s390x.rpm rh-ruby27-rubygem-racc-1.4.16-131.el7.s390x.rpm x86_64: rh-ruby27-ruby-2.7.6-131.el7.x86_64.rpm rh-ruby27-ruby-debuginfo-2.7.6-131.el7.x86_64.rpm rh-ruby27-ruby-devel-2.7.6-131.el7.x86_64.rpm rh-ruby27-ruby-libs-2.7.6-131.el7.x86_64.rpm rh-ruby27-rubygem-bigdecimal-2.0.0-131.el7.x86_64.rpm rh-ruby27-rubygem-io-console-0.5.6-131.el7.x86_64.rpm rh-ruby27-rubygem-json-2.3.0-131.el7.x86_64.rpm rh-ruby27-rubygem-openssl-2.1.3-131.el7.x86_64.rpm rh-ruby27-rubygem-psych-3.1.0-131.el7.x86_64.rpm rh-ruby27-rubygem-racc-1.4.16-131.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-ruby27-ruby-2.7.6-131.el7.src.rpm noarch: rh-ruby27-ruby-doc-2.7.6-131.el7.noarch.rpm rh-ruby27-rubygem-bundler-2.2.24-131.el7.noarch.rpm rh-ruby27-rubygem-did_you_mean-1.4.0-131.el7.noarch.rpm rh-ruby27-rubygem-irb-1.2.6-131.el7.noarch.rpm rh-ruby27-rubygem-minitest-5.13.0-131.el7.noarch.rpm rh-ruby27-rubygem-net-telnet-0.2.0-131.el7.noarch.rpm rh-ruby27-rubygem-power_assert-1.1.7-131.el7.noarch.rpm rh-ruby27-rubygem-rake-13.0.1-131.el7.noarch.rpm rh-ruby27-rubygem-rdoc-6.2.1.1-131.el7.noarch.rpm rh-ruby27-rubygem-test-unit-3.3.4-131.el7.noarch.rpm rh-ruby27-rubygem-xmlrpc-0.3.0-131.el7.noarch.rpm rh-ruby27-rubygems-3.1.6-131.el7.noarch.rpm rh-ruby27-rubygems-devel-3.1.6-131.el7.noarch.rpm x86_64: rh-ruby27-ruby-2.7.6-131.el7.x86_64.rpm rh-ruby27-ruby-debuginfo-2.7.6-131.el7.x86_64.rpm rh-ruby27-ruby-devel-2.7.6-131.el7.x86_64.rpm rh-ruby27-ruby-libs-2.7.6-131.el7.x86_64.rpm rh-ruby27-rubygem-bigdecimal-2.0.0-131.el7.x86_64.rpm rh-ruby27-rubygem-io-console-0.5.6-131.el7.x86_64.rpm rh-ruby27-rubygem-json-2.3.0-131.el7.x86_64.rpm rh-ruby27-rubygem-openssl-2.1.3-131.el7.x86_64.rpm rh-ruby27-rubygem-psych-3.1.0-131.el7.x86_64.rpm rh-ruby27-rubygem-racc-1.4.16-131.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-41816 https://access.redhat.com/security/cve/CVE-2021-41817 https://access.redhat.com/security/cve/CVE-2021-41819 https://access.redhat.com/security/cve/CVE-2022-28739 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY0UvxdzjgjWX9erEAQi9PA//fVhNa9hyZTb/kZrIXEt8OtDgZE/mhMod bvrJ9X6LmHS5C5WSGwjlN7qm5tZJ7Y45VT/l2qD/W6SiqG0nulMGDN97/B09vrOd XQk5Q6UmtSVJNju81MMqYL+ZS3SMTq69dKN9dGwj7YaA4QgJPL9ZQjPEmPvaabwd WbWnJmx1x4omc1+KTXlHpKSCFJSRXCo1YFJf90W3uDoWUiVlbTMxUMxJ1+BM/CvF 8YhuWH/aH7ubG2sGsiFpwaqM3t518WxIdhyQIbRsLhj3KaOFYkQQD5v9Zy9Wr9Ts svs74mbBIy4uxnbTdINb+jzSA3CvqXBJseV0e56ZCJ2zh7WPEtht0L+WgVEvdxrw o+gfV7fp95d5VPRfJR1hg+ScMFmqsQEkHe/AQT9dVztxgieD33TvC7ze2vXRiqra cr3XDBvFh5/guAsYtnduJa7JQzkEd2L0KS6pOWpnxdPIIIaL5wy4CT7OzCQzpCnI ZkO/pILOjh2sNc1sxADsTv8hUHQdYa4BRp+vM8bAcrKDRuYkT9Wv5vLOYy/9/lBj lPMk9q2XAc1jFZROFhFt37hCZadcqJlWIXqTURWxKKt4Hr/ULfNfQBhtmogqB02z wHNBJ0jIbjI9ED1cixhflDLRUMXZi5gerGvRoIjIVNMCd7Xfp26vii/zsDlzhUEN 3OLyXI8SVsQ=Z/DV -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce