-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: ruby:2.7 security, bug fix, and enhancement update Advisory ID: RHSA-2023:3821-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:3821 Issue date: 2023-06-27 CVE Names: CVE-2021-33621 CVE-2023-28755 CVE-2023-28756 ===================================================================== 1. Summary: An update for the ruby:2.7 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (2.7). (BZ#2189465) Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2149706 - CVE-2021-33621 ruby/cgi-gem: HTTP response splitting in CGI 2184059 - CVE-2023-28755 ruby: ReDoS vulnerability in URI 2184061 - CVE-2023-28756 ruby: ReDoS vulnerability in Time 2189465 - ruby:2.7/ruby: Rebase to the latest Ruby 2.7 release [rhel-8] [rhel-8.8.0.z] 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: ruby-2.7.8-139.module+el8.8.0+18745+f1bef313.src.rpm rubygem-abrt-0.4.0-1.module+el8.3.0+7192+4e3a532a.src.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.src.rpm rubygem-mongo-2.11.3-1.module+el8.3.0+7192+4e3a532a.src.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.src.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.src.rpm aarch64: ruby-2.7.8-139.module+el8.8.0+18745+f1bef313.aarch64.rpm ruby-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.aarch64.rpm ruby-debugsource-2.7.8-139.module+el8.8.0+18745+f1bef313.aarch64.rpm ruby-devel-2.7.8-139.module+el8.8.0+18745+f1bef313.aarch64.rpm ruby-libs-2.7.8-139.module+el8.8.0+18745+f1bef313.aarch64.rpm ruby-libs-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-bigdecimal-2.0.0-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-bigdecimal-debuginfo-2.0.0-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-io-console-0.5.6-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-io-console-debuginfo-0.5.6-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-json-2.3.0-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-json-debuginfo-2.3.0-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-openssl-2.1.4-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-openssl-debuginfo-2.1.4-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-psych-3.1.0-139.module+el8.8.0+18745+f1bef313.aarch64.rpm rubygem-psych-debuginfo-3.1.0-139.module+el8.8.0+18745+f1bef313.aarch64.rpm noarch: ruby-default-gems-2.7.8-139.module+el8.8.0+18745+f1bef313.noarch.rpm ruby-doc-2.7.8-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-abrt-0.4.0-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-abrt-doc-0.4.0-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-bson-doc-4.8.1-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-bundler-2.2.24-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-irb-1.2.6-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-minitest-5.13.0-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-mongo-2.11.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-mongo-doc-2.11.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-mysql2-doc-0.5.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-net-telnet-0.2.0-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-pg-doc-1.2.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-power_assert-1.1.7-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-rake-13.0.1-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-rdoc-6.2.1.1-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-test-unit-3.3.4-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygem-xmlrpc-0.3.0-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygems-3.1.6-139.module+el8.8.0+18745+f1bef313.noarch.rpm rubygems-devel-3.1.6-139.module+el8.8.0+18745+f1bef313.noarch.rpm ppc64le: ruby-2.7.8-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm ruby-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm ruby-debugsource-2.7.8-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm ruby-devel-2.7.8-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm ruby-libs-2.7.8-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm ruby-libs-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-bigdecimal-2.0.0-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-bigdecimal-debuginfo-2.0.0-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-io-console-0.5.6-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-io-console-debuginfo-0.5.6-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-json-2.3.0-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-json-debuginfo-2.3.0-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-openssl-2.1.4-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-openssl-debuginfo-2.1.4-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-psych-3.1.0-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm rubygem-psych-debuginfo-3.1.0-139.module+el8.8.0+18745+f1bef313.ppc64le.rpm s390x: ruby-2.7.8-139.module+el8.8.0+18745+f1bef313.s390x.rpm ruby-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.s390x.rpm ruby-debugsource-2.7.8-139.module+el8.8.0+18745+f1bef313.s390x.rpm ruby-devel-2.7.8-139.module+el8.8.0+18745+f1bef313.s390x.rpm ruby-libs-2.7.8-139.module+el8.8.0+18745+f1bef313.s390x.rpm ruby-libs-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-bigdecimal-2.0.0-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-bigdecimal-debuginfo-2.0.0-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-io-console-0.5.6-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-io-console-debuginfo-0.5.6-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-json-2.3.0-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-json-debuginfo-2.3.0-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-openssl-2.1.4-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-openssl-debuginfo-2.1.4-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-psych-3.1.0-139.module+el8.8.0+18745+f1bef313.s390x.rpm rubygem-psych-debuginfo-3.1.0-139.module+el8.8.0+18745+f1bef313.s390x.rpm x86_64: ruby-2.7.8-139.module+el8.8.0+18745+f1bef313.i686.rpm ruby-2.7.8-139.module+el8.8.0+18745+f1bef313.x86_64.rpm ruby-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.i686.rpm ruby-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.x86_64.rpm ruby-debugsource-2.7.8-139.module+el8.8.0+18745+f1bef313.i686.rpm ruby-debugsource-2.7.8-139.module+el8.8.0+18745+f1bef313.x86_64.rpm ruby-devel-2.7.8-139.module+el8.8.0+18745+f1bef313.i686.rpm ruby-devel-2.7.8-139.module+el8.8.0+18745+f1bef313.x86_64.rpm ruby-libs-2.7.8-139.module+el8.8.0+18745+f1bef313.i686.rpm ruby-libs-2.7.8-139.module+el8.8.0+18745+f1bef313.x86_64.rpm ruby-libs-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.i686.rpm ruby-libs-debuginfo-2.7.8-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-bigdecimal-2.0.0-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-bigdecimal-2.0.0-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-bigdecimal-debuginfo-2.0.0-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-bigdecimal-debuginfo-2.0.0-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-io-console-0.5.6-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-io-console-0.5.6-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-io-console-debuginfo-0.5.6-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-io-console-debuginfo-0.5.6-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-json-2.3.0-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-json-2.3.0-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-json-debuginfo-2.3.0-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-json-debuginfo-2.3.0-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-openssl-2.1.4-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-openssl-2.1.4-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-openssl-debuginfo-2.1.4-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-openssl-debuginfo-2.1.4-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-psych-3.1.0-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-psych-3.1.0-139.module+el8.8.0+18745+f1bef313.x86_64.rpm rubygem-psych-debuginfo-3.1.0-139.module+el8.8.0+18745+f1bef313.i686.rpm rubygem-psych-debuginfo-3.1.0-139.module+el8.8.0+18745+f1bef313.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-33621 https://access.redhat.com/security/cve/CVE-2023-28755 https://access.redhat.com/security/cve/CVE-2023-28756 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZJsFV9zjgjWX9erEAQhGJg/8CSYl7Y6VuELUVr0d8Qe3nX8QgQ6EoDna jGsPLVjb2Rytisas2Qq18Fyhai9G+vk7Ra1bXHGEQr+AS12LZWyLfCNStnytnXKe Fl6hA22SlQ8WunK1hb3UmcX9KH8se3zV8gVrAfekFYvw/Ifdnb4uoNg0rbLS/F/L X3dYIZO1z5ee+Eb8yBIzwJ9QSO+g41xVi2Rn1ljsk/muaSQ9gUzRHJ6lB0cB6c7m 3vshI5P6VdwlveMZ01uoqjYHUNRnLNWA4S3e8bxl4knizKJGocElIxg6Q5hyEd9j kb+vHl2h6mWG0aik6khT+0btxnSXNAKATYeHNUIV9uO95nzIHWkLFxrT+vn5A79p vLXJZFjchlqvxyetMTrZ+EwKgErcjMAZRD1q3TRK9TH3QVO7dlrwL4kDY945Zc+g 7Sbfuc+Qj1bqyz6jrF6VV+S1A+T/07BdsfBcXKV3v0i4+wQktt87O5xaDz+h9tN/ MWstL84d3lZE/BGnvhNL6VDaU1bfTUR+1t1rQk9dffXGjsJ0qmk6tB2H5ZV+lHT/ LW33w68eubFbOU4rofZopQ//fYpX53NMtsqEp8K9aY/uR5N/WNyXuDIRzlIm1nEx /kN1kKX1jWLT3caD0mC7r+1obFVttic9h+2P3vtnFQA0Afziq9R02c8IWe9PcX2h GouuIDZf+sw= =d6PW -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce