RHSA-2021:3982: Important: rh-ruby30-ruby security update
First published: Mon Oct 25 2021(Updated: )
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. <br>The following packages have been upgraded to a later upstream version: rh-ruby30-ruby (3.0.2).<br>Security Fix(es):<br><li> rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)</li> <li> rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)</li> <li> ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)</li> <li> ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rh-ruby30-ruby | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-debuginfo | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-default-gems | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-devel | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-doc | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-libs | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-rubygem-bigdecimal | <3.0.0-148.el7 | 3.0.0-148.el7 |
| redhat/rh-ruby30-rubygem-bundler | <2.2.22-148.el7 | 2.2.22-148.el7 |
| redhat/rh-ruby30-rubygem-io-console | <0.5.7-148.el7 | 0.5.7-148.el7 |
| redhat/rh-ruby30-rubygem-irb | <1.3.5-148.el7 | 1.3.5-148.el7 |
| redhat/rh-ruby30-rubygem-json | <2.5.1-148.el7 | 2.5.1-148.el7 |
| redhat/rh-ruby30-rubygem-minitest | <5.14.2-148.el7 | 5.14.2-148.el7 |
| redhat/rh-ruby30-rubygem-psych | <3.3.0-148.el7 | 3.3.0-148.el7 |
| redhat/rh-ruby30-rubygem-rake | <13.0.3-148.el7 | 13.0.3-148.el7 |
| redhat/rh-ruby30-rubygem-rbs | <1.0.4-148.el7 | 1.0.4-148.el7 |
| redhat/rh-ruby30-rubygem-rexml | <3.2.5-148.el7 | 3.2.5-148.el7 |
| redhat/rh-ruby30-rubygem-rss | <0.2.9-148.el7 | 0.2.9-148.el7 |
| redhat/rh-ruby30-rubygem-test-unit | <3.3.7-148.el7 | 3.3.7-148.el7 |
| redhat/rh-ruby30-rubygem-typeprof | <0.12.0-148.el7 | 0.12.0-148.el7 |
| redhat/rh-ruby30-rubygems | <3.2.22-148.el7 | 3.2.22-148.el7 |
| redhat/rh-ruby30-rubygems-devel | <3.2.22-148.el7 | 3.2.22-148.el7 |
| redhat/rh-ruby30-ruby-debuginfo | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-devel | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-libs | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-rubygem-bigdecimal | <3.0.0-148.el7 | 3.0.0-148.el7 |
| redhat/rh-ruby30-rubygem-io-console | <0.5.7-148.el7 | 0.5.7-148.el7 |
| redhat/rh-ruby30-rubygem-json | <2.5.1-148.el7 | 2.5.1-148.el7 |
| redhat/rh-ruby30-rubygem-psych | <3.3.0-148.el7 | 3.3.0-148.el7 |
| redhat/rh-ruby30-ruby | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-debuginfo | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-devel | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-ruby-libs | <3.0.2-148.el7 | 3.0.2-148.el7 |
| redhat/rh-ruby30-rubygem-bigdecimal | <3.0.0-148.el7 | 3.0.0-148.el7 |
| redhat/rh-ruby30-rubygem-io-console | <0.5.7-148.el7 | 0.5.7-148.el7 |
| redhat/rh-ruby30-rubygem-json | <2.5.1-148.el7 | 2.5.1-148.el7 |
| redhat/rh-ruby30-rubygem-psych | <3.3.0-148.el7 | 3.3.0-148.el7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1958999
- https://bugzilla.redhat.com/show_bug.cgi?id=1980126
- https://bugzilla.redhat.com/show_bug.cgi?id=1980128
- https://bugzilla.redhat.com/show_bug.cgi?id=1980132
- https://access.redhat.com/security/updates/classification/#important
- https://access.redhat.com/errata/RHSA-2021:3982 (Advisory)
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2021:3982
- agent/software-canonical-lookup
- package-manager/redhat