RHSA-2007:0961: Moderate: ruby security update
Ruby is an interpreted scripting language for object-oriented programming.A flaw was discovered in the way Ruby's CGI module handles certain HTTPrequests. If a remote attacker sends a specially crafted request, it ispossible to cause the ruby CGI script to enter an infinite loop, possiblycausing a denial of service. (CVE-2006-6303)An SSL certificate validation flaw was discovered in several Ruby Netmodules. The libraries were not checking the requested host name againstthe common name (CN) in the SSL server certificate, possibly allowing a manin the middle attack. (CVE-2007-5162, CVE-2007-5770)Users of Ruby should upgrade to these updated packages, which containbackported patches to resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2007:0961?
The severity of RHSA-2007:0961 is classified as moderate.
How do I fix RHSA-2007:0961?
To fix RHSA-2007:0961, update to the latest version of Ruby that addresses this CGI module vulnerability.
What are the potential effects of RHSA-2007:0961?
Exploiting RHSA-2007:0961 could allow an attacker to cause the Ruby CGI script to enter an infinite loop.
Who is affected by RHSA-2007:0961?
Any systems running vulnerable versions of Ruby's CGI module are at risk from RHSA-2007:0961.
How can I determine if my system is vulnerable to RHSA-2007:0961?
You can check if your system is running an affected version of Ruby's CGI module that has not been patched to mitigate the vulnerability.