- Vulnerability/
- RHSA-2019:1151
RHSA-2019:1151: Important: rh-ruby23-ruby security update
First published: Mon May 13 2019(Updated: )
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.<br>Security Fix(es):<br><li> rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rh-ruby23-ruby | <2.3.8-70.el7 | 2.3.8-70.el7 |
| redhat/rh-ruby23-ruby | <2.3.8-70.el7 | 2.3.8-70.el7 |
| redhat/rh-ruby23-ruby-debuginfo | <2.3.8-70.el7 | 2.3.8-70.el7 |
| redhat/rh-ruby23-ruby-devel | <2.3.8-70.el7 | 2.3.8-70.el7 |
| redhat/rh-ruby23-ruby-doc | <2.3.8-70.el7 | 2.3.8-70.el7 |
| redhat/rh-ruby23-ruby-irb | <2.3.8-70.el7 | 2.3.8-70.el7 |
| redhat/rh-ruby23-ruby-libs | <2.3.8-70.el7 | 2.3.8-70.el7 |
| redhat/rh-ruby23-ruby-tcltk | <2.3.8-70.el7 | 2.3.8-70.el7 |
| redhat/rh-ruby23-rubygem-bigdecimal | <1.2.8-70.el7 | 1.2.8-70.el7 |
| redhat/rh-ruby23-rubygem-io-console | <0.4.5-70.el7 | 0.4.5-70.el7 |
| redhat/rh-ruby23-rubygem-json | <1.8.3.1-70.el7 | 1.8.3.1-70.el7 |
| redhat/rh-ruby23-rubygem-minitest | <5.8.5-70.el7 | 5.8.5-70.el7 |
| redhat/rh-ruby23-rubygem-net-telnet | <0.1.1-70.el7 | 0.1.1-70.el7 |
| redhat/rh-ruby23-rubygem-psych | <2.1.0.1-70.el7 | 2.1.0.1-70.el7 |
| redhat/rh-ruby23-rubygem-rake | <10.4.2-70.el7 | 10.4.2-70.el7 |
| redhat/rh-ruby23-rubygem-rdoc | <4.2.1-70.el7 | 4.2.1-70.el7 |
| redhat/rh-ruby23-rubygem-test-unit | <3.1.5-70.el7 | 3.1.5-70.el7 |
| redhat/rh-ruby23-rubygems | <2.5.2.3-70.el7 | 2.5.2.3-70.el7 |
| redhat/rh-ruby23-rubygems-devel | <2.5.2.3-70.el7 | 2.5.2.3-70.el7 |
| redhat/rh-ruby23-ruby | <2.3.8-70.el6 | 2.3.8-70.el6 |
| redhat/rh-ruby23-ruby | <2.3.8-70.el6 | 2.3.8-70.el6 |
| redhat/rh-ruby23-ruby-debuginfo | <2.3.8-70.el6 | 2.3.8-70.el6 |
| redhat/rh-ruby23-ruby-devel | <2.3.8-70.el6 | 2.3.8-70.el6 |
| redhat/rh-ruby23-ruby-doc | <2.3.8-70.el6 | 2.3.8-70.el6 |
| redhat/rh-ruby23-ruby-irb | <2.3.8-70.el6 | 2.3.8-70.el6 |
| redhat/rh-ruby23-ruby-libs | <2.3.8-70.el6 | 2.3.8-70.el6 |
| redhat/rh-ruby23-ruby-tcltk | <2.3.8-70.el6 | 2.3.8-70.el6 |
| redhat/rh-ruby23-rubygem-bigdecimal | <1.2.8-70.el6 | 1.2.8-70.el6 |
| redhat/rh-ruby23-rubygem-io-console | <0.4.5-70.el6 | 0.4.5-70.el6 |
| redhat/rh-ruby23-rubygem-json | <1.8.3.1-70.el6 | 1.8.3.1-70.el6 |
| redhat/rh-ruby23-rubygem-minitest | <5.8.5-70.el6 | 5.8.5-70.el6 |
| redhat/rh-ruby23-rubygem-net-telnet | <0.1.1-70.el6 | 0.1.1-70.el6 |
| redhat/rh-ruby23-rubygem-psych | <2.1.0.1-70.el6 | 2.1.0.1-70.el6 |
| redhat/rh-ruby23-rubygem-rake | <10.4.2-70.el6 | 10.4.2-70.el6 |
| redhat/rh-ruby23-rubygem-rdoc | <4.2.1-70.el6 | 4.2.1-70.el6 |
| redhat/rh-ruby23-rubygem-test-unit | <3.1.5-70.el6 | 3.1.5-70.el6 |
| redhat/rh-ruby23-rubygems | <2.5.2.3-70.el6 | 2.5.2.3-70.el6 |
| redhat/rh-ruby23-rubygems-devel | <2.5.2.3-70.el6 | 2.5.2.3-70.el6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of RHSA-2019:1151?
The severity of RHSA-2019:1151 is classified as important.
What vulnerability is addressed in RHSA-2019:1151?
RHSA-2019:1151 addresses a vulnerability in rubygems that may allow for arbitrary code execution when installing a malicious gem, referenced as CVE-2019-8324.
How do I fix RHSA-2019:1151?
To fix RHSA-2019:1151, update the affected packages to the specified versions: 2.3.8-70.el7 or newer.
Which packages are affected by RHSA-2019:1151?
Affected packages include rh-ruby23-ruby, rh-ruby23-rubygems, and related ruby and rubygem packages.
Is there a workaround for RHSA-2019:1151 until I can apply the update?
No specific workarounds are suggested for RHSA-2019:1151; applying the update is recommended.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2019:1151
- agent/software-canonical-lookup
- package-manager/redhat