ALSA-2024:1431

Dashboard / Vulnerabilities / ALSA-2024:1431

ALSA-2024:1431

Summary: Moderate: ruby:3.1 security, bug fix, and enhancement update

Details: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.1). (AlmaLinux-28565) Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) Bug Fix(es): * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (AlmaLinux-28569) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References: https://access.redhat.com/errata/RHSA-2024:1431, https://access.redhat.com/security/cve/CVE-2021-33621, https://access.redhat.com/security/cve/CVE-2023-28755, https://access.redhat.com/security/cve/CVE-2023-28756, https://access.redhat.com/security/cve/CVE-2023-36617, https://bugzilla.redhat.com/2149706, https://bugzilla.redhat.com/2184059, https://bugzilla.redhat.com/2184061, https://bugzilla.redhat.com/2218614, https://errata.almalinux.org/8/ALSA-2024-1431.html