Most recent entries from all

ALSA-2021:3020 — Important: ruby:2.7 security update

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc and 21 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

* rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

* ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

* ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-05398

Withdrawn: BELL-CVE-2021-31799 — CVE-2021-31799 does not affect BellSoft software

Withdrawn by the publisher.

CLEANSTART-2026-ZN97904 — Security fix for CVE-2021-31799 applied in: ruby 2.7.4-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-195926

fkie_cve-2021-31799

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

GHSA-ggxm-pgc9-g7fp — Arbitrary Code Execution in Rdoc

Affected: RubyGems: rdoc

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

gsd-2021-31799

OESA-2021-1306 — ruby security update

Affected: openEuler:20.03-LTS-SP1: ruby, openEuler:20.03-LTS-SP2: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es): In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.(CVE-2021-31799) An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).(CVE-2021-31810) An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."(CVE-2021-32066)

openSUSE-SU-2021:1535-1 — Security update for ruby2.5

Security update for ruby2.5

RHSA-2021:3559 — Red Hat Security Advisory: rh-ruby27-ruby security update

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source rubygem-rdoc: Command injection vulnerability in RDoc ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host ruby: StartTLS stripping vulnerability in Net::IMAP

SUSE-SU-2021:3837-1 — Security update for ruby2.1

Security update for ruby2.1

UBUNTU-CVE-2021-31799

Affected: Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:18.04:LTS: ruby2.5, Ubuntu:20.04:LTS: ruby2.7

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

WID-SEC-W-2023-2461 — Ruby: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby ausnutzen, um beliebigen Programmcode auszuführen.