-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: rh-ruby26-ruby security, bug fix, and enhancement update
Advisory ID:       RHSA-2021:2230-01
Product:           Red Hat Software Collections
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:2230
Issue date:        2021-06-03
CVE Names:         CVE-2019-3881 CVE-2019-15845 CVE-2019-16201 
                   CVE-2019-16254 CVE-2019-16255 CVE-2020-10663 
                   CVE-2020-10933 CVE-2020-25613 CVE-2021-28965 
====================================================================
1. Summary:

An update for rh-ruby26-ruby is now available for Red Hat Software
Collections.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

3. Description:

Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to perform system management tasks. 

The following packages have been upgraded to a later upstream version:
rh-ruby26-ruby (2.6.7). (BZ#1701182)

Security Fix(es):

* rubygem-bundler: Insecure permissions on directory in /tmp/ allows for
execution of malicious code (CVE-2019-3881)

* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?
(CVE-2019-15845)

* ruby: Regular expression denial of service vulnerability of WEBrick's
Digest authentication (CVE-2019-16201)

* ruby: Code injection via command argument of Shell#test / Shell#[]
(CVE-2019-16255)

* rubygem-json: Unsafe object creation vulnerability in JSON
(CVE-2020-10663)

* ruby: BasicSocket#read_nonblock method leads to information disclosure
(CVE-2020-10933)

* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* rh-ruby26-ruby: Resolv::DNS: timeouts if multiple IPv6 name servers are
given and address contains leading zero [rhscl-3] (BZ#1950331)

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Software Collections 3.7 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1651826 - CVE-2019-3881 rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code
1773728 - CVE-2019-16201 ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication
1789407 - CVE-2019-15845 ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?
1789556 - CVE-2019-16254 ruby: HTTP response splitting in WEBrick
1793683 - CVE-2019-16255 ruby: Code injection via command argument of Shell#test / Shell#[]
1827500 - CVE-2020-10663 rubygem-json: Unsafe object creation vulnerability in JSON
1833291 - CVE-2020-10933 ruby: BasicSocket#read_nonblock method leads to information disclosure
1883623 - CVE-2020-25613 ruby: Potential HTTP request smuggling in WEBrick
1947526 - CVE-2021-28965 ruby: XML round-trip vulnerability in REXML
1950331 - rh-ruby26-ruby: Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains leading zero [rhscl-3]

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source:
rh-ruby26-ruby-2.6.7-119.el7.src.rpm

noarch:
rh-ruby26-ruby-doc-2.6.7-119.el7.noarch.rpm
rh-ruby26-rubygem-bundler-1.17.2-119.el7.noarch.rpm
rh-ruby26-rubygem-did_you_mean-1.3.0-119.el7.noarch.rpm
rh-ruby26-rubygem-irb-1.0.0-119.el7.noarch.rpm
rh-ruby26-rubygem-minitest-5.11.3-119.el7.noarch.rpm
rh-ruby26-rubygem-net-telnet-0.2.0-119.el7.noarch.rpm
rh-ruby26-rubygem-power_assert-1.1.3-119.el7.noarch.rpm
rh-ruby26-rubygem-rake-12.3.3-119.el7.noarch.rpm
rh-ruby26-rubygem-rdoc-6.1.2-119.el7.noarch.rpm
rh-ruby26-rubygem-test-unit-3.2.9-119.el7.noarch.rpm
rh-ruby26-rubygem-xmlrpc-0.3.0-119.el7.noarch.rpm
rh-ruby26-rubygems-3.0.3.1-119.el7.noarch.rpm
rh-ruby26-rubygems-devel-3.0.3.1-119.el7.noarch.rpm

ppc64le:
rh-ruby26-ruby-2.6.7-119.el7.ppc64le.rpm
rh-ruby26-ruby-debuginfo-2.6.7-119.el7.ppc64le.rpm
rh-ruby26-ruby-devel-2.6.7-119.el7.ppc64le.rpm
rh-ruby26-ruby-libs-2.6.7-119.el7.ppc64le.rpm
rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.ppc64le.rpm
rh-ruby26-rubygem-io-console-0.4.7-119.el7.ppc64le.rpm
rh-ruby26-rubygem-json-2.1.0-119.el7.ppc64le.rpm
rh-ruby26-rubygem-openssl-2.1.2-119.el7.ppc64le.rpm
rh-ruby26-rubygem-psych-3.1.0-119.el7.ppc64le.rpm

s390x:
rh-ruby26-ruby-2.6.7-119.el7.s390x.rpm
rh-ruby26-ruby-debuginfo-2.6.7-119.el7.s390x.rpm
rh-ruby26-ruby-devel-2.6.7-119.el7.s390x.rpm
rh-ruby26-ruby-libs-2.6.7-119.el7.s390x.rpm
rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.s390x.rpm
rh-ruby26-rubygem-io-console-0.4.7-119.el7.s390x.rpm
rh-ruby26-rubygem-json-2.1.0-119.el7.s390x.rpm
rh-ruby26-rubygem-openssl-2.1.2-119.el7.s390x.rpm
rh-ruby26-rubygem-psych-3.1.0-119.el7.s390x.rpm

x86_64:
rh-ruby26-ruby-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-debuginfo-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-devel-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-libs-2.6.7-119.el7.x86_64.rpm
rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.x86_64.rpm
rh-ruby26-rubygem-io-console-0.4.7-119.el7.x86_64.rpm
rh-ruby26-rubygem-json-2.1.0-119.el7.x86_64.rpm
rh-ruby26-rubygem-openssl-2.1.2-119.el7.x86_64.rpm
rh-ruby26-rubygem-psych-3.1.0-119.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7):

Source:
rh-ruby26-ruby-2.6.7-119.el7.src.rpm

noarch:
rh-ruby26-ruby-doc-2.6.7-119.el7.noarch.rpm
rh-ruby26-rubygem-bundler-1.17.2-119.el7.noarch.rpm
rh-ruby26-rubygem-did_you_mean-1.3.0-119.el7.noarch.rpm
rh-ruby26-rubygem-irb-1.0.0-119.el7.noarch.rpm
rh-ruby26-rubygem-minitest-5.11.3-119.el7.noarch.rpm
rh-ruby26-rubygem-net-telnet-0.2.0-119.el7.noarch.rpm
rh-ruby26-rubygem-power_assert-1.1.3-119.el7.noarch.rpm
rh-ruby26-rubygem-rake-12.3.3-119.el7.noarch.rpm
rh-ruby26-rubygem-rdoc-6.1.2-119.el7.noarch.rpm
rh-ruby26-rubygem-test-unit-3.2.9-119.el7.noarch.rpm
rh-ruby26-rubygem-xmlrpc-0.3.0-119.el7.noarch.rpm
rh-ruby26-rubygems-3.0.3.1-119.el7.noarch.rpm
rh-ruby26-rubygems-devel-3.0.3.1-119.el7.noarch.rpm

ppc64le:
rh-ruby26-ruby-2.6.7-119.el7.ppc64le.rpm
rh-ruby26-ruby-debuginfo-2.6.7-119.el7.ppc64le.rpm
rh-ruby26-ruby-devel-2.6.7-119.el7.ppc64le.rpm
rh-ruby26-ruby-libs-2.6.7-119.el7.ppc64le.rpm
rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.ppc64le.rpm
rh-ruby26-rubygem-io-console-0.4.7-119.el7.ppc64le.rpm
rh-ruby26-rubygem-json-2.1.0-119.el7.ppc64le.rpm
rh-ruby26-rubygem-openssl-2.1.2-119.el7.ppc64le.rpm
rh-ruby26-rubygem-psych-3.1.0-119.el7.ppc64le.rpm

s390x:
rh-ruby26-ruby-2.6.7-119.el7.s390x.rpm
rh-ruby26-ruby-debuginfo-2.6.7-119.el7.s390x.rpm
rh-ruby26-ruby-devel-2.6.7-119.el7.s390x.rpm
rh-ruby26-ruby-libs-2.6.7-119.el7.s390x.rpm
rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.s390x.rpm
rh-ruby26-rubygem-io-console-0.4.7-119.el7.s390x.rpm
rh-ruby26-rubygem-json-2.1.0-119.el7.s390x.rpm
rh-ruby26-rubygem-openssl-2.1.2-119.el7.s390x.rpm
rh-ruby26-rubygem-psych-3.1.0-119.el7.s390x.rpm

x86_64:
rh-ruby26-ruby-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-debuginfo-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-devel-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-libs-2.6.7-119.el7.x86_64.rpm
rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.x86_64.rpm
rh-ruby26-rubygem-io-console-0.4.7-119.el7.x86_64.rpm
rh-ruby26-rubygem-json-2.1.0-119.el7.x86_64.rpm
rh-ruby26-rubygem-openssl-2.1.2-119.el7.x86_64.rpm
rh-ruby26-rubygem-psych-3.1.0-119.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source:
rh-ruby26-ruby-2.6.7-119.el7.src.rpm

noarch:
rh-ruby26-ruby-doc-2.6.7-119.el7.noarch.rpm
rh-ruby26-rubygem-bundler-1.17.2-119.el7.noarch.rpm
rh-ruby26-rubygem-did_you_mean-1.3.0-119.el7.noarch.rpm
rh-ruby26-rubygem-irb-1.0.0-119.el7.noarch.rpm
rh-ruby26-rubygem-minitest-5.11.3-119.el7.noarch.rpm
rh-ruby26-rubygem-net-telnet-0.2.0-119.el7.noarch.rpm
rh-ruby26-rubygem-power_assert-1.1.3-119.el7.noarch.rpm
rh-ruby26-rubygem-rake-12.3.3-119.el7.noarch.rpm
rh-ruby26-rubygem-rdoc-6.1.2-119.el7.noarch.rpm
rh-ruby26-rubygem-test-unit-3.2.9-119.el7.noarch.rpm
rh-ruby26-rubygem-xmlrpc-0.3.0-119.el7.noarch.rpm
rh-ruby26-rubygems-3.0.3.1-119.el7.noarch.rpm
rh-ruby26-rubygems-devel-3.0.3.1-119.el7.noarch.rpm

x86_64:
rh-ruby26-ruby-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-debuginfo-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-devel-2.6.7-119.el7.x86_64.rpm
rh-ruby26-ruby-libs-2.6.7-119.el7.x86_64.rpm
rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.x86_64.rpm
rh-ruby26-rubygem-io-console-0.4.7-119.el7.x86_64.rpm
rh-ruby26-rubygem-json-2.1.0-119.el7.x86_64.rpm
rh-ruby26-rubygem-openssl-2.1.2-119.el7.x86_64.rpm
rh-ruby26-rubygem-psych-3.1.0-119.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-3881
https://access.redhat.com/security/cve/CVE-2019-15845
https://access.redhat.com/security/cve/CVE-2019-16201
https://access.redhat.com/security/cve/CVE-2019-16254
https://access.redhat.com/security/cve/CVE-2019-16255
https://access.redhat.com/security/cve/CVE-2020-10663
https://access.redhat.com/security/cve/CVE-2020-10933
https://access.redhat.com/security/cve/CVE-2020-25613
https://access.redhat.com/security/cve/CVE-2021-28965
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.7_release_notes/

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYLi8ltzjgjWX9erEAQi7IA/8C86NMaSfOxaQEY15WzNUFZtcT0OfDkBo
KMT5uuXXcwj+rpJGF6kqAAW9chI/HVNshKYXXpOeByffFW+5KLlRB1G6mw9LiOIc
SZHX1BhK6dxObWtnPQcqE0JDhb16+sb0GQY3+70szm0iMtFjRiwzNTGHy/T6S+nr
poCvsrg/5/mPvKtV32x80T6a5sJxFsW5siYfv1DJeoH7LGnBLkAU4vRCJ3IBdQaX
yeEAhx6QjKQG6xfB2YD2SsNliALYId1ytKQcs0IgCsk9IuVOX+Vl1cKU/GFrGp8a
UVbTap6gb10YrclTz5ssDlE4NXXPFOx4nX8wI4QxeNam2Sy3tD0uhfgGaN5OdXiz
CJZnwE/qIaxzzNMf0TdXaAtYZ7InEr6xjBlc5ncInvI0aQaiDWLKL6odgrLkfboa
a+0leBVx3FeREY//WMw5LT1mRzqsnYaK3qT9C6tfxF/NTBFmZmVmJmbC6PiTZWfK
T5KjjZJpmbIo1JvjIaWzWCZT8dDhoxSvNWk0CefLlI3/SsUyCURfjmJc7zpbNmzJ
l0jIG9kjHVriRjhoWUWBzY7z7QkGx+tU0KYKB1Kx+J1BDXMdLaeJ7ubJIJRBQ4F/
A+75BfTYoxEHjF171or+rIGkOGadwCerTggyNuFi8aQSk4KWmROCFUoiYbEtYxp4
UD6NGAugxlg=k+Dm
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-2230:01 Moderate: rh-ruby26-ruby security, bug fix,

An update for rh-ruby26-ruby is now available for Red Hat Software Collections

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
The following packages have been upgraded to a later upstream version: rh-ruby26-ruby (2.6.7). (BZ#1701182)
Security Fix(es):
* rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)
* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)
* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)
* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)
* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)
* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)
* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)
* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)
* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* rh-ruby26-ruby: Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains leading zero [rhscl-3] (BZ#1950331)
Additional Changes:
For detailed information on changes in this release, see the Red Hat Software Collections 3.7 Release Notes linked from the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2019-3881 https://access.redhat.com/security/cve/CVE-2019-15845 https://access.redhat.com/security/cve/CVE-2019-16201 https://access.redhat.com/security/cve/CVE-2019-16254 https://access.redhat.com/security/cve/CVE-2019-16255 https://access.redhat.com/security/cve/CVE-2020-10663 https://access.redhat.com/security/cve/CVE-2020-10933 https://access.redhat.com/security/cve/CVE-2020-25613 https://access.redhat.com/security/cve/CVE-2021-28965 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.7_release_notes/

Package List

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source: rh-ruby26-ruby-2.6.7-119.el7.src.rpm
noarch: rh-ruby26-ruby-doc-2.6.7-119.el7.noarch.rpm rh-ruby26-rubygem-bundler-1.17.2-119.el7.noarch.rpm rh-ruby26-rubygem-did_you_mean-1.3.0-119.el7.noarch.rpm rh-ruby26-rubygem-irb-1.0.0-119.el7.noarch.rpm rh-ruby26-rubygem-minitest-5.11.3-119.el7.noarch.rpm rh-ruby26-rubygem-net-telnet-0.2.0-119.el7.noarch.rpm rh-ruby26-rubygem-power_assert-1.1.3-119.el7.noarch.rpm rh-ruby26-rubygem-rake-12.3.3-119.el7.noarch.rpm rh-ruby26-rubygem-rdoc-6.1.2-119.el7.noarch.rpm rh-ruby26-rubygem-test-unit-3.2.9-119.el7.noarch.rpm rh-ruby26-rubygem-xmlrpc-0.3.0-119.el7.noarch.rpm rh-ruby26-rubygems-3.0.3.1-119.el7.noarch.rpm rh-ruby26-rubygems-devel-3.0.3.1-119.el7.noarch.rpm
ppc64le: rh-ruby26-ruby-2.6.7-119.el7.ppc64le.rpm rh-ruby26-ruby-debuginfo-2.6.7-119.el7.ppc64le.rpm rh-ruby26-ruby-devel-2.6.7-119.el7.ppc64le.rpm rh-ruby26-ruby-libs-2.6.7-119.el7.ppc64le.rpm rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.ppc64le.rpm rh-ruby26-rubygem-io-console-0.4.7-119.el7.ppc64le.rpm rh-ruby26-rubygem-json-2.1.0-119.el7.ppc64le.rpm rh-ruby26-rubygem-openssl-2.1.2-119.el7.ppc64le.rpm rh-ruby26-rubygem-psych-3.1.0-119.el7.ppc64le.rpm
s390x: rh-ruby26-ruby-2.6.7-119.el7.s390x.rpm rh-ruby26-ruby-debuginfo-2.6.7-119.el7.s390x.rpm rh-ruby26-ruby-devel-2.6.7-119.el7.s390x.rpm rh-ruby26-ruby-libs-2.6.7-119.el7.s390x.rpm rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.s390x.rpm rh-ruby26-rubygem-io-console-0.4.7-119.el7.s390x.rpm rh-ruby26-rubygem-json-2.1.0-119.el7.s390x.rpm rh-ruby26-rubygem-openssl-2.1.2-119.el7.s390x.rpm rh-ruby26-rubygem-psych-3.1.0-119.el7.s390x.rpm
x86_64: rh-ruby26-ruby-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-debuginfo-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-devel-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-libs-2.6.7-119.el7.x86_64.rpm rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.x86_64.rpm rh-ruby26-rubygem-io-console-0.4.7-119.el7.x86_64.rpm rh-ruby26-rubygem-json-2.1.0-119.el7.x86_64.rpm rh-ruby26-rubygem-openssl-2.1.2-119.el7.x86_64.rpm rh-ruby26-rubygem-psych-3.1.0-119.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7):
Source: rh-ruby26-ruby-2.6.7-119.el7.src.rpm
noarch: rh-ruby26-ruby-doc-2.6.7-119.el7.noarch.rpm rh-ruby26-rubygem-bundler-1.17.2-119.el7.noarch.rpm rh-ruby26-rubygem-did_you_mean-1.3.0-119.el7.noarch.rpm rh-ruby26-rubygem-irb-1.0.0-119.el7.noarch.rpm rh-ruby26-rubygem-minitest-5.11.3-119.el7.noarch.rpm rh-ruby26-rubygem-net-telnet-0.2.0-119.el7.noarch.rpm rh-ruby26-rubygem-power_assert-1.1.3-119.el7.noarch.rpm rh-ruby26-rubygem-rake-12.3.3-119.el7.noarch.rpm rh-ruby26-rubygem-rdoc-6.1.2-119.el7.noarch.rpm rh-ruby26-rubygem-test-unit-3.2.9-119.el7.noarch.rpm rh-ruby26-rubygem-xmlrpc-0.3.0-119.el7.noarch.rpm rh-ruby26-rubygems-3.0.3.1-119.el7.noarch.rpm rh-ruby26-rubygems-devel-3.0.3.1-119.el7.noarch.rpm
ppc64le: rh-ruby26-ruby-2.6.7-119.el7.ppc64le.rpm rh-ruby26-ruby-debuginfo-2.6.7-119.el7.ppc64le.rpm rh-ruby26-ruby-devel-2.6.7-119.el7.ppc64le.rpm rh-ruby26-ruby-libs-2.6.7-119.el7.ppc64le.rpm rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.ppc64le.rpm rh-ruby26-rubygem-io-console-0.4.7-119.el7.ppc64le.rpm rh-ruby26-rubygem-json-2.1.0-119.el7.ppc64le.rpm rh-ruby26-rubygem-openssl-2.1.2-119.el7.ppc64le.rpm rh-ruby26-rubygem-psych-3.1.0-119.el7.ppc64le.rpm
s390x: rh-ruby26-ruby-2.6.7-119.el7.s390x.rpm rh-ruby26-ruby-debuginfo-2.6.7-119.el7.s390x.rpm rh-ruby26-ruby-devel-2.6.7-119.el7.s390x.rpm rh-ruby26-ruby-libs-2.6.7-119.el7.s390x.rpm rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.s390x.rpm rh-ruby26-rubygem-io-console-0.4.7-119.el7.s390x.rpm rh-ruby26-rubygem-json-2.1.0-119.el7.s390x.rpm rh-ruby26-rubygem-openssl-2.1.2-119.el7.s390x.rpm rh-ruby26-rubygem-psych-3.1.0-119.el7.s390x.rpm
x86_64: rh-ruby26-ruby-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-debuginfo-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-devel-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-libs-2.6.7-119.el7.x86_64.rpm rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.x86_64.rpm rh-ruby26-rubygem-io-console-0.4.7-119.el7.x86_64.rpm rh-ruby26-rubygem-json-2.1.0-119.el7.x86_64.rpm rh-ruby26-rubygem-openssl-2.1.2-119.el7.x86_64.rpm rh-ruby26-rubygem-psych-3.1.0-119.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source: rh-ruby26-ruby-2.6.7-119.el7.src.rpm
noarch: rh-ruby26-ruby-doc-2.6.7-119.el7.noarch.rpm rh-ruby26-rubygem-bundler-1.17.2-119.el7.noarch.rpm rh-ruby26-rubygem-did_you_mean-1.3.0-119.el7.noarch.rpm rh-ruby26-rubygem-irb-1.0.0-119.el7.noarch.rpm rh-ruby26-rubygem-minitest-5.11.3-119.el7.noarch.rpm rh-ruby26-rubygem-net-telnet-0.2.0-119.el7.noarch.rpm rh-ruby26-rubygem-power_assert-1.1.3-119.el7.noarch.rpm rh-ruby26-rubygem-rake-12.3.3-119.el7.noarch.rpm rh-ruby26-rubygem-rdoc-6.1.2-119.el7.noarch.rpm rh-ruby26-rubygem-test-unit-3.2.9-119.el7.noarch.rpm rh-ruby26-rubygem-xmlrpc-0.3.0-119.el7.noarch.rpm rh-ruby26-rubygems-3.0.3.1-119.el7.noarch.rpm rh-ruby26-rubygems-devel-3.0.3.1-119.el7.noarch.rpm
x86_64: rh-ruby26-ruby-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-debuginfo-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-devel-2.6.7-119.el7.x86_64.rpm rh-ruby26-ruby-libs-2.6.7-119.el7.x86_64.rpm rh-ruby26-rubygem-bigdecimal-1.4.1-119.el7.x86_64.rpm rh-ruby26-rubygem-io-console-0.4.7-119.el7.x86_64.rpm rh-ruby26-rubygem-json-2.1.0-119.el7.x86_64.rpm rh-ruby26-rubygem-openssl-2.1.2-119.el7.x86_64.rpm rh-ruby26-rubygem-psych-3.1.0-119.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2021:2230-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2021:2230
Issued Date: : 2021-06-03
CVE Names: CVE-2019-3881 CVE-2019-15845 CVE-2019-16201 CVE-2019-16254 CVE-2019-16255 CVE-2020-10663 CVE-2020-10933 CVE-2020-25613 CVE-2021-28965

Topic

An update for rh-ruby26-ruby is now available for Red Hat SoftwareCollections.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch, ppc64le, s390x, x86_64

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64


Bugs Fixed

1651826 - CVE-2019-3881 rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code

1773728 - CVE-2019-16201 ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication

1789407 - CVE-2019-15845 ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch?

1789556 - CVE-2019-16254 ruby: HTTP response splitting in WEBrick

1793683 - CVE-2019-16255 ruby: Code injection via command argument of Shell#test / Shell#[]

1827500 - CVE-2020-10663 rubygem-json: Unsafe object creation vulnerability in JSON

1833291 - CVE-2020-10933 ruby: BasicSocket#read_nonblock method leads to information disclosure

1883623 - CVE-2020-25613 ruby: Potential HTTP request smuggling in WEBrick

1947526 - CVE-2021-28965 ruby: XML round-trip vulnerability in REXML

1950331 - rh-ruby26-ruby: Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains leading zero [rhscl-3]


Related News

19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved