Most recent entries from all

ALSA-2022:0543 — Important: ruby:2.6 security update

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc, AlmaLinux:8: rubygem-bundler and 21 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

* rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

* ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

* ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

* ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

* ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-05714

Withdrawn: BELL-CVE-2021-41817 — CVE-2021-41817 does not affect BellSoft software

Withdrawn by the publisher.

BIT-ruby-2021-41817

Affected: Bitnami: ruby

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

CLEANSTART-2026-KK38106 — Security fix for CVE-2021-41817 applied in: ruby 3.0.3-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-31884

fkie_cve-2021-41817

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

GHSA-qg54-694p-wgpp — Regular expression denial of service vulnerability (ReDoS) in date

Affected: RubyGems: date

Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected.

The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse.

Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import `date` from the standard library rather than as a gem you should update your Ruby install to `3.0.3`, `2.7.5`, `2.6.9` or later.

Users unable to upgrade may consider using `Date.strptime` instead with a predefined date format ```ruby Date.strptime('2001-02-20', '%Y-%m-%d') ```

gsd-2021-41817

msrc_CVE-2021-41817 — Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string…

msrc_CVE-2021-41817

OESA-2024-2581 — ruby security update

Affected: openEuler:20.03-LTS-SP4: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es): (CVE-2021-41817)

openSUSE-SU-2024:11657-1 — libruby2_7-2_7-2.7.5-1.1 on GA media

libruby2_7-2_7-2.7.5-1.1 on GA media

RHSA-2022:0544 — Red Hat Security Advisory: ruby:2.6 security update

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source rubygem-rdoc: Command injection vulnerability in RDoc ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host ruby: StartTLS stripping vulnerability in Net::IMAP ruby: Regular expression denial of service vulnerability of Date parsing methods ruby: Cookie prefix spoofing in CGI::Cookie.parse

SUSE-SU-2022:1512-1 — Security update for ruby2.5

Security update for ruby2.5

UBUNTU-CVE-2021-41817

Affected: Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:18.04:LTS: ruby2.5, Ubuntu:20.04:LTS: ruby2.7, Ubuntu:22.04:LTS: ruby3.0

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.