-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-ruby30-ruby security, bug fix, and enhancement update Advisory ID: RHSA-2022:6855-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2022:6855 Issue date: 2022-10-11 CVE Names: CVE-2021-41816 CVE-2021-41817 CVE-2021-41819 CVE-2022-28738 CVE-2022-28739 ==================================================================== 1. Summary: An update for rh-ruby30-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: rh-ruby30-ruby (3.0.4). (BZ#2128628) Security Fix(es): * ruby: buffer overflow in CGI.escape_html (CVE-2021-41816) * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817) * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819) * Ruby: Double free in Regexp compilation (CVE-2022-28738) * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * rh-ruby30 ruby: User-installed rubygems plugins are not being loaded (BZ#2128629) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2025104 - CVE-2021-41817 ruby: Regular expression denial of service vulnerability of Date parsing methods 2026752 - CVE-2021-41816 ruby: buffer overflow in CGI.escape_html 2026757 - CVE-2021-41819 ruby: Cookie prefix spoofing in CGI::Cookie.parse 2075685 - CVE-2022-28738 Ruby: Double free in Regexp compilation 2075687 - CVE-2022-28739 Ruby: Buffer overrun in String-to-Float conversion 2128628 - rh-ruby30-ruby: Rebase to the latest Ruby 3.0 release [rhscl-3] [rhscl-3.8.z] 2128629 - rh-ruby30 ruby: User-installed rubygems plugins are not being loaded [rhscl-3.8.z] 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-ruby30-ruby-3.0.4-149.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.4-149.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.4-149.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.33-149.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-149.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-149.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-149.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-149.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.4.0-149.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-149.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-149.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-149.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.15.2-149.el7.noarch.rpm rh-ruby30-rubygems-3.2.33-149.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.33-149.el7.noarch.rpm ppc64le: rh-ruby30-ruby-3.0.4-149.el7.ppc64le.rpm rh-ruby30-ruby-debuginfo-3.0.4-149.el7.ppc64le.rpm rh-ruby30-ruby-devel-3.0.4-149.el7.ppc64le.rpm rh-ruby30-ruby-libs-3.0.4-149.el7.ppc64le.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-149.el7.ppc64le.rpm rh-ruby30-rubygem-io-console-0.5.7-149.el7.ppc64le.rpm rh-ruby30-rubygem-json-2.5.1-149.el7.ppc64le.rpm rh-ruby30-rubygem-psych-3.3.2-149.el7.ppc64le.rpm s390x: rh-ruby30-ruby-3.0.4-149.el7.s390x.rpm rh-ruby30-ruby-debuginfo-3.0.4-149.el7.s390x.rpm rh-ruby30-ruby-devel-3.0.4-149.el7.s390x.rpm rh-ruby30-ruby-libs-3.0.4-149.el7.s390x.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-149.el7.s390x.rpm rh-ruby30-rubygem-io-console-0.5.7-149.el7.s390x.rpm rh-ruby30-rubygem-json-2.5.1-149.el7.s390x.rpm rh-ruby30-rubygem-psych-3.3.2-149.el7.s390x.rpm x86_64: rh-ruby30-ruby-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.4-149.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-149.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-149.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-149.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.2-149.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-ruby30-ruby-3.0.4-149.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.4-149.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.4-149.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.33-149.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-149.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-149.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-149.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-149.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.4.0-149.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-149.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-149.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-149.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.15.2-149.el7.noarch.rpm rh-ruby30-rubygems-3.2.33-149.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.33-149.el7.noarch.rpm x86_64: rh-ruby30-ruby-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.4-149.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.4-149.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-149.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-149.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-149.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.2-149.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-41816 https://access.redhat.com/security/cve/CVE-2021-41817 https://access.redhat.com/security/cve/CVE-2021-41819 https://access.redhat.com/security/cve/CVE-2022-28738 https://access.redhat.com/security/cve/CVE-2022-28739 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY0Uv1tzjgjWX9erEAQgAKhAAjX8disZOm8gqwL8MxMVbPzYaxXlNCWSn /kI4e6oxz7lzw9tjdOmrdw9qgXVGY4EZAcZtkkDuQZFY6/1OfXWrFsCWInbbr6e/ 7SzF9a2XTyAxOLF1XU8IgyMKJ8TOQfsg/5CTGZpm8rIV+FjsS1u1SwhGXF1J/MWG TA3jlhLlqJusAGbl2xH3sjBc1ljaha3iVXstBxEfQQLJAisJf9xemU6hh45ceT90 TOiJyRh+JqdBHXv/41l+n/4fChH1oGnk6guQPbggPrTCKMvv55VS4x4vUYDMAdXc w6P3De5hutdjiJzOZwvm6PlaHQOAYRlRAbFh21T6p1HhunTBYTRxqh+BK42ygAnP 3AKhsUf/um6cMv2SWmvzEoA8xNDxaR1FKryzilpqgCyJhbf3Cx8xkWn1dyryTNwM d2k2anM9LbgiG05qRIV1QZcndiAZwL4fPTWE0yLd4H5a7kURkIYTwgVr8qAC5yYC 8R58XG7whyp+zvmc+RNUCCGcIEZ9p3Fbw5x6Lz5Y0CvMV0y4R5H+qcqSqPlKeJGI XBCgwpKxML+7bq0eqBmheLp4XYjvbgpMKlFU/ladFg9/a2NcbHiidxtcvHzEPcq8 oEuHjfaXnyTi7KC4PjHnDAaXxjrDsTrSNIBAcdbXA+p2ZE5FXcmRmrY3Qqz1i44j Q10rz6cYwlE=yEyk -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce