USN-6838-2: Ruby vulnerability
USN-6838-1 fixed CVE-2024-27281 in Ruby 2.7, Ruby 3.0, Ruby 3.1, and Ruby 3.2. This update provides the corresponding updates for Ruby 2.3 and Ruby 2.5. Original advisory details: It was discovered that Ruby RDoc incorrectly parsed certain YAML files. If a user or automated system were tricked into parsing a specially crafted .rdocoptions file, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2024-27281)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6838-2?
The severity of USN-6838-2 is classified as important due to potential security vulnerabilities in Ruby RDoc.
How do I fix USN-6838-2?
To fix USN-6838-2, users should upgrade to the patched versions of Ruby 2.3 and 2.5 provided in the update.
Which versions of Ruby are affected by USN-6838-2?
USN-6838-2 affects Ruby versions 2.3 and 2.5, specifically on Ubuntu 16.04 and 18.04.
What is the cause of the vulnerability in USN-6838-2?
The vulnerability in USN-6838-2 is due to Ruby RDoc incorrectly parsing certain YAML files.
Is my system at risk if I use Ruby 2.3 or 2.5 on Ubuntu 16.04 or 18.04?
Yes, systems running Ruby 2.3 or 2.5 on Ubuntu 16.04 or 18.04 without the latest updates are at risk.