RHSA-2024:3668: Moderate: ruby:3.1 security, bug fix, and enhancement update
Moderate: ruby:3.1 security, bug fix, and enhancement update
Other sources
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.The following packages have been upgraded to a later upstream version: ruby (3.1). (RHEL-35449)Security Fix(es): ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280) ruby: RCE vulnerability with .rdocoptions in RDoc (CVE-2024-27281) ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-mysql2to a version that resolves this vulnerability.Fixed in 0.5.4-1.module+el9.1.0+15737+76195479 - Upgrade
Upgrade
redhat/rubygem-pgto a version that resolves this vulnerability.Fixed in 1.3.5-1.module+el9.1.0+15737+76195479 - Upgrade
Upgrade
redhat/ruby-default-gemsto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/ruby-docto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-bundlerto a version that resolves this vulnerability.Fixed in 2.3.27-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-irbto a version that resolves this vulnerability.Fixed in 1.4.1-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-minitestto a version that resolves this vulnerability.Fixed in 5.15.0-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-mysql2-docto a version that resolves this vulnerability.Fixed in 0.5.4-1.module+el9.1.0+15737+76195479 - Upgrade
Upgrade
redhat/rubygem-pg-docto a version that resolves this vulnerability.Fixed in 1.3.5-1.module+el9.1.0+15737+76195479 - Upgrade
Upgrade
redhat/rubygem-raketo a version that resolves this vulnerability.Fixed in 13.0.6-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-rdocto a version that resolves this vulnerability.Fixed in 6.4.1.1-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-rexmlto a version that resolves this vulnerability.Fixed in 3.2.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-rssto a version that resolves this vulnerability.Fixed in 0.2.9-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-test-unitto a version that resolves this vulnerability.Fixed in 3.5.3-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-typeprofto a version that resolves this vulnerability.Fixed in 0.21.3-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygemsto a version that resolves this vulnerability.Fixed in 3.3.27-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygems-develto a version that resolves this vulnerability.Fixed in 3.3.27-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/ruby-bundled-gemsto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/ruby-bundled-gems-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/ruby-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/ruby-debugsourceto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/ruby-develto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/ruby-libsto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/ruby-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-bigdecimalto a version that resolves this vulnerability.Fixed in 3.1.1-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-bigdecimal-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.1-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-io-consoleto a version that resolves this vulnerability.Fixed in 0.5.11-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-io-console-debuginfoto a version that resolves this vulnerability.Fixed in 0.5.11-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-jsonto a version that resolves this vulnerability.Fixed in 2.6.1-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-json-debuginfoto a version that resolves this vulnerability.Fixed in 2.6.1-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-mysql2-debuginfoto a version that resolves this vulnerability.Fixed in 0.5.4-1.module+el9.1.0+15737+76195479 - Upgrade
Upgrade
redhat/rubygem-mysql2-debugsourceto a version that resolves this vulnerability.Fixed in 0.5.4-1.module+el9.1.0+15737+76195479 - Upgrade
Upgrade
redhat/rubygem-pg-debuginfoto a version that resolves this vulnerability.Fixed in 1.3.5-1.module+el9.1.0+15737+76195479 - Upgrade
Upgrade
redhat/rubygem-pg-debugsourceto a version that resolves this vulnerability.Fixed in 1.3.5-1.module+el9.1.0+15737+76195479 - Upgrade
Upgrade
redhat/rubygem-psychto a version that resolves this vulnerability.Fixed in 4.0.4-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-psych-debuginfoto a version that resolves this vulnerability.Fixed in 4.0.4-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-rbsto a version that resolves this vulnerability.Fixed in 2.7.0-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubygem-rbs-debuginfoto a version that resolves this vulnerability.Fixed in 2.7.0-144.module+el9.4.0+21780+79b7bdb5 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/ruby-bundled-gemsto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/ruby-bundled-gems-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/ruby-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/ruby-debugsourceto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/ruby-develto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/ruby-libsto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/ruby-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-bigdecimalto a version that resolves this vulnerability.Fixed in 3.1.1-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-bigdecimal-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.1-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-io-consoleto a version that resolves this vulnerability.Fixed in 0.5.11-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-io-console-debuginfoto a version that resolves this vulnerability.Fixed in 0.5.11-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-jsonto a version that resolves this vulnerability.Fixed in 2.6.1-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-json-debuginfoto a version that resolves this vulnerability.Fixed in 2.6.1-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-mysql2to a version that resolves this vulnerability.Fixed in 0.5.4-1.module+el9.1.0+15737+76195479.aa - Upgrade
Upgrade
redhat/rubygem-mysql2-debuginfoto a version that resolves this vulnerability.Fixed in 0.5.4-1.module+el9.1.0+15737+76195479.aa - Upgrade
Upgrade
redhat/rubygem-mysql2-debugsourceto a version that resolves this vulnerability.Fixed in 0.5.4-1.module+el9.1.0+15737+76195479.aa - Upgrade
Upgrade
redhat/rubygem-pgto a version that resolves this vulnerability.Fixed in 1.3.5-1.module+el9.1.0+15737+76195479.aa - Upgrade
Upgrade
redhat/rubygem-pg-debuginfoto a version that resolves this vulnerability.Fixed in 1.3.5-1.module+el9.1.0+15737+76195479.aa - Upgrade
Upgrade
redhat/rubygem-pg-debugsourceto a version that resolves this vulnerability.Fixed in 1.3.5-1.module+el9.1.0+15737+76195479.aa - Upgrade
Upgrade
redhat/rubygem-psychto a version that resolves this vulnerability.Fixed in 4.0.4-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-psych-debuginfoto a version that resolves this vulnerability.Fixed in 4.0.4-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-rbsto a version that resolves this vulnerability.Fixed in 2.7.0-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
redhat/rubygem-rbs-debuginfoto a version that resolves this vulnerability.Fixed in 2.7.0-144.module+el9.4.0+21780+79b7bdb5.aa - Upgrade
Upgrade
rubyto a version that resolves this vulnerability.Fixed in 3.1
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:3668?
The severity of RHSA-2024:3668 is categorized as moderate.
How do I fix RHSA-2024:3668?
To fix RHSA-2024:3668, upgrade the relevant packages to version 3.1.5-144.module+el9.4.0+21780+79b7bdb5.
Which packages are affected by RHSA-2024:3668?
Affected packages include ruby, rubygem-mysql2, rubygem-pg, and several others in Red Hat Enterprise Linux.
Does RHSA-2024:3668 affect all versions of Ruby?
No, RHSA-2024:3668 specifically affects Ruby version 3.1.
Is it necessary to reboot after applying the fix for RHSA-2024:3668?
Rebooting is not necessary after applying the fix for RHSA-2024:3668, but it's a good practice to ensure all services are restarted.