Synopsis: Moderate: ruby security update Advisory ID: SLSA-2019:2028-1 Issue Date: 2019-08-06 CVE Numbers: CVE-2018-8779 CVE-2018-1000077 CVE-2018-8780 CVE-2018-1000075 CVE-2018-1000078 CVE-2018-6914 CVE-2018-8777 CVE-2018-1000076 CVE-2017-17742 CVE-2018-1000079 CVE-2018-1000073 CVE-2018-1000074 CVE-2018-8778 CVE-2018-16396 -- Security Fix(es): * ruby: HTTP response splitting in WEBrick (CVE-2017-17742) * ruby: DoS by large request in WEBrick (CVE-2018-8777) * ruby: Buffer under-read in String#unpack (CVE-2018-8778) * ruby: Unintentional directory traversal by poisoned NULL byte in Dir (CVE-2018-8780) * ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives (CVE-2018-16396) * rubygems: Path traversal when writing to a symlinked basedir outside of the root (CVE-2018-1000073) * rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (CVE-2018-1000074) * rubygems: Improper verification of signatures in tarball allows to install mis-signed gem (CVE-2018-1000076) * rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (CVE-2018-1000077) * rubygems: XSS vulnerability in homepage attribute when displayed via gem server (CVE-2018-1000078) * rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations (CVE-2018-1000079) * ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (CVE-2018-6914) * ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket (CVE-2018-8779) * rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service (CVE-2018-1000075) -- SL7 x86_64 rubygem-json-1.7.7-36.el7.x86_64.rpm rubygems-2.0.14.1-36.el7.noarch.rpm rubygem-bigdecimal-1.2.0-36.el7.x86_64.rpm ruby-irb-2.0.0.648-36.el7.noarch.rpm rubygem-io-console-0.4.2-36.el7.x86_64.rpm rubygem-psych-2.0.0-36.el7.x86_64.rpm ruby-2.0.0.648-36.el7.x86_64.rpm rubygem-rdoc-4.0.0-36.el7.noarch.rpm ruby-libs-2.0.0.648-36.el7.i686.rpm ruby-libs-2.0.0.648-36.el7.x86_64.rpm ruby-tcltk-2.0.0.648-36.el7.x86_64.rpm ruby-devel-2.0.0.648-36.el7.x86_64.rpm rubygem-minitest-4.3.2-36.el7.noarch.rpm rubygems-devel-2.0.14.1-36.el7.noarch.rpm ruby-doc-2.0.0.648-36.el7.noarch.rpm rubygem-rake-0.9.6-36.el7.noarch.rpm ruby-debuginfo-2.0.0.648-36.el7.i686.rpm ruby-debuginfo-2.0.0.648-36.el7.x86_64.rpm noarch ruby-irb-2.0.0.648-36.el7.noarch.rpm rubygem-rdoc-4.0.0-36.el7.noarch.rpm rubygems-2.0.14.1-36.el7.noarch.rpm ruby-doc-2.0.0.648-36.el7.noarch.rpm rubygem-minitest-4.3.2-36.el7.noarch.rpm rubygem-rake-0.9.6-36.el7.noarch.rpm rubygems-devel-2.0.14.1-36.el7.noarch.rpm - Scientific Linux Development Team