Most recent entries from all

ALSA-2021:2587 — Moderate: ruby:2.5 security, bug fix, and enhancement update

Affected: AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc, AlmaLinux:8: rubygem-mongo, AlmaLinux:8: rubygem-mongo-doc, AlmaLinux:8: rubygem-mysql2, AlmaLinux:8: rubygem-mysql2-doc, AlmaLinux:8: rubygem-pg, AlmaLinux:8: rubygem-pg-doc

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626)

Security Fix(es):

* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)

* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2020-02445

Withdrawn: BELL-CVE-2020-10933 — CVE-2020-10933 does not affect BellSoft software

Withdrawn by the publisher.

BIT-ruby-2020-10933

Affected: Bitnami: ruby

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.

certfr-2021-avi-788 — De multiples vulnérabilités ont été découvertes dans IBM Cloud Foundry Migration Runtime. Certaines d'entre elles perme…

certfr-2021-avi-788

CLEANSTART-2026-VM37834 — Security fix for CVE-2020-10933 applied in: ruby 2.6.6-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2020-23171

EUVD-2026-40218

fkie_cve-2020-10933

GHSA-g5hm-28jr-53fh

gsd-2020-10933

msrc_CVE-2020-10933 — An issue was discovered in Ruby 2.5.x through 2.5.7 2.6.x through 2.6.5 and 2.7.0. If a victim calls BasicSocket#read_n…

msrc_CVE-2020-10933

openSUSE-SU-2020:0586-1 — Security update for ruby2.5

Security update for ruby2.5

RHSA-2021:2104 — Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update

ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication ruby: HTTP response splitting in WEBrick ruby: Code injection via command argument of Shell#test / Shell#[] rubygem-json: Unsafe object creation vulnerability in JSON ruby: BasicSocket#read_nonblock method leads to information disclosure ruby: Potential HTTP request smuggling in WEBrick ruby: XML round-trip vulnerability in REXML

SUSE-SU-2020:0995-1 — Security update for ruby2.5

Security update for ruby2.5

UBUNTU-CVE-2020-10933

Affected: Ubuntu:18.04:LTS: ruby2.5, Ubuntu:20.04:LTS: ruby2.7

WID-SEC-W-2023-2476 — Ruby: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Informationen offenzulegen oder weitere, nicht näher spezifizierte Angriffe durchzuführen.