Most recent entries from all

ALSA-2021:2587 — Moderate: ruby:2.5 security, bug fix, and enhancement update

Affected: AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc, AlmaLinux:8: rubygem-mongo, AlmaLinux:8: rubygem-mongo-doc, AlmaLinux:8: rubygem-mysql2, AlmaLinux:8: rubygem-mysql2-doc, AlmaLinux:8: rubygem-pg, AlmaLinux:8: rubygem-pg-doc

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626)

Security Fix(es):

* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2020-00865

Withdrawn: BELL-CVE-2019-16201 — CVE-2019-16201 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-788 — De multiples vulnérabilités ont été découvertes dans IBM Cloud Foundry Migration Runtime. Certaines d'entre elles perme…

certfr-2021-avi-788

CLEANSTART-2026-BG69188 — Security fix for CVE-2019-16201 applied in: ruby 2.6.5-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-57620

fkie_cve-2019-16201

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.

GHSA-26h5-qgg3-p324

gsd-2019-16201

msrc_CVE-2019-16201 — WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7 2.5.x through 2.5.6 and 2.6.x through 2.6.4 has a regular expressio…

msrc_CVE-2019-16201

openSUSE-SU-2020:0395-1 — Recommended update for ruby2.5

Recommended update for ruby2.5

RHSA-2021:2104 — Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update

ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication ruby: HTTP response splitting in WEBrick ruby: Code injection via command argument of Shell#test / Shell#[] rubygem-json: Unsafe object creation vulnerability in JSON ruby: BasicSocket#read_nonblock method leads to information disclosure ruby: Potential HTTP request smuggling in WEBrick ruby: XML round-trip vulnerability in REXML

SUSE-SU-2020:0737-1 — Recommended update for ruby2.5

Recommended update for ruby2.5

UBUNTU-CVE-2019-16201

Affected: Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:20.04:LTS: jruby, Ubuntu:24.04:LTS: jruby, Ubuntu:25.10: jruby, Ubuntu:26.04:LTS: jruby

WID-SEC-W-2023-1110 — Ruby: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren oder einen Denial of Servie zu verursachen.