Most recent entries from all

ALSA-2021:2584 — Moderate: ruby:2.7 security, bug fix, and enhancement update

Affected: AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc, AlmaLinux:8: rubygem-mongo, AlmaLinux:8: rubygem-mongo-doc, AlmaLinux:8: rubygem-mysql2, AlmaLinux:8: rubygem-mysql2-doc, AlmaLinux:8: rubygem-pg, AlmaLinux:8: rubygem-pg-doc

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7.3). (BZ#1951999)

Security Fix(es):

* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Resolv::DNS: ruby:2.7/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [almalinux-8] (BZ#1952000)

bdu:2022-00302

Withdrawn: BELL-CVE-2021-28965 — CVE-2021-28965 does not affect BellSoft software

Withdrawn by the publisher.

BIT-ruby-2021-28965

Affected: Bitnami: ruby

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

BREW-asciidoctor-CVE-2021-28965 — REXML round-trip instability

Affected: Homebrew: asciidoctor

certfr-2021-avi-267 — De multiples vulnérabilités ont été découvertes dans les produits Gitlab. Elles permettent à un attaquant de provoquer…

certfr-2021-avi-267

CLEANSTART-2026-BM82320 — Security fix for CVE-2021-28965 applied in: ruby 2.7.3-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-26134

fkie_cve-2021-28965

GHSA-8cr8-4vfw-mr7h — REXML round-trip instability

Affected: RubyGems: rexml

gsd-2021-28965

msrc_CVE-2021-28965 — The REXML gem before 3.2.5 in Ruby before 2.6.7 2.7.x before 2.7.3 and 3.x before 3.0.1 does not properly address XML r…

msrc_CVE-2021-28965

OESA-2021-1259 — ruby security update

Affected: openEuler:20.03-LTS-SP1: ruby

Security Fix(es): The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.(CVE-2021-28965)

openSUSE-SU-2021:0607-1 — Security update for ruby2.5

Security update for ruby2.5

RHSA-2021:2104 — Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update

ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication ruby: HTTP response splitting in WEBrick ruby: Code injection via command argument of Shell#test / Shell#[] rubygem-json: Unsafe object creation vulnerability in JSON ruby: BasicSocket#read_nonblock method leads to information disclosure ruby: Potential HTTP request smuggling in WEBrick ruby: XML round-trip vulnerability in REXML

SUSE-SU-2021:1280-1 — Security update for ruby2.5

Security update for ruby2.5

UBUNTU-CVE-2021-28965

Affected: Ubuntu:16.04:LTS: ruby2.3, Ubuntu:18.04:LTS: ruby2.5, Ubuntu:20.04:LTS: ruby2.7

WID-SEC-W-2023-2462 — Ruby: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Dateien zu manipulieren.