Vulnerability-Lookup

RHSA-2022_0582

Vulnerability from csaf_redhat - Published: 2022-02-21 09:04 - Updated: 2024-11-15 12:00

Summary

Red Hat Security Advisory: ruby:2.6 security update

Severity

Important

Notes

Topic: An update for the ruby:2.6 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327) * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845) * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201) * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255) * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663) * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933) * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613) * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965) * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799) * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810) * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817) * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819) * ruby: HTTP response splitting in WEBrick (CVE-2019-16254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2019-15845

A flaw was discovered in Ruby in the way certain functions handled strings containing NULL bytes. Specifically, the built-in methods File.fnmatch and its alias File.fnmatch? did not properly handle path patterns containing the NULL byte. A remote attacker could exploit this flaw to make a Ruby script access unexpected files and to bypass intended file system access restrictions.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-41 - Improper Resolution of Path Equivalence

Affected products

Fixed 143 products

Product	Version	Remediation
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-doc-0:2.6.9-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-abrt-0:0.3.0-4.module+el8.1.0+3653+beb38eb0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-abrt-0:0.3.0-4.module+el8.1.0+3653+beb38eb0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-abrt-doc-0:0.3.0-4.module+el8.1.0+3653+beb38eb0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debuginfo-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debuginfo-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debuginfo-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debuginfo-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debugsource-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debugsource-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debugsource-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debugsource-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-doc-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bundler-0:1.17.2-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-did_you_mean-0:1.3.0-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-irb-0:1.0.0-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-minitest-0:5.11.3-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mongo-0:2.8.0-1.module+el8.1.0+3653+beb38eb0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mongo-0:2.8.0-1.module+el8.1.0+3653+beb38eb0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mongo-doc-0:2.8.0-1.module+el8.1.0+3653+beb38eb0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debuginfo-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debuginfo-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debuginfo-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debuginfo-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debugsource-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debugsource-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debugsource-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debugsource-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-doc-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-net-telnet-0:0.2.0-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debuginfo-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debuginfo-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debuginfo-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debuginfo-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debugsource-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debugsource-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debugsource-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debugsource-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-doc-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-power_assert-0:1.1.3-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-rake-0:12.3.3-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-rdoc-0:6.1.2.1-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-test-unit-0:3.2.9-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-xmlrpc-0:0.3.0-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygems-0:3.0.3.1-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygems-devel-0:3.0.3.1-107.module+el8.2.0+14086+86d863af.noarch	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2019-16201

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2019-16254

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Low

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2020-10663

A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem (including the one bundled with Ruby) can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2020-10933

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2020-25613

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2020-36327

A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a source-restricted gem could be installed form a different source if that repository provided higher version of the package. This could lead to installation of a malicious gem version and arbitrary code execution.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-494 - Download of Code Without Integrity Check

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84		—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bundler-0:1.17.2-107.module+el8.2.0+14086+86d863af.noarch		—	Vendor Fix fix Workaround

Known not affected 141 products

Product	Version	Remediation
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.src	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-debugsource-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-devel-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-doc-0:2.6.9-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:ruby-libs-debuginfo-0:2.6.9-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-abrt-0:0.3.0-4.module+el8.1.0+3653+beb38eb0.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-abrt-0:0.3.0-4.module+el8.1.0+3653+beb38eb0.src	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-abrt-doc-0:0.3.0-4.module+el8.1.0+3653+beb38eb0.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-0:1.4.1-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bigdecimal-debuginfo-0:1.4.1-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.src	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debuginfo-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debuginfo-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debuginfo-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debuginfo-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debugsource-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debugsource-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debugsource-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-debugsource-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-bson-doc-0:4.5.0-1.module+el8.1.0+3653+beb38eb0.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-did_you_mean-0:1.3.0-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-0:0.4.7-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-io-console-debuginfo-0:0.4.7-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-irb-0:1.0.0-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-0:2.1.0-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-json-debuginfo-0:2.1.0-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-minitest-0:5.11.3-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mongo-0:2.8.0-1.module+el8.1.0+3653+beb38eb0.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mongo-0:2.8.0-1.module+el8.1.0+3653+beb38eb0.src	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mongo-doc-0:2.8.0-1.module+el8.1.0+3653+beb38eb0.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.src	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debuginfo-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debuginfo-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debuginfo-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debuginfo-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debugsource-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debugsource-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debugsource-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-debugsource-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-mysql2-doc-0:0.5.2-1.module+el8.1.0+3653+beb38eb0.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-net-telnet-0:0.2.0-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-0:2.1.2-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-openssl-debuginfo-0:2.1.2-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.src	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debuginfo-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debuginfo-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debuginfo-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debuginfo-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debugsource-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debugsource-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debugsource-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-debugsource-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-pg-doc-0:1.1.4-1.module+el8.1.0+3653+beb38eb0.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-power_assert-0:1.1.3-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-0:3.1.0-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.aarch64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.i686	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.ppc64le	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.s390x	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-psych-debuginfo-0:3.1.0-107.module+el8.2.0+14086+86d863af.x86_64	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-rake-0:12.3.3-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-rdoc-0:6.1.2.1-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-test-unit-0:3.2.9-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygem-xmlrpc-0:0.3.0-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygems-0:3.0.3.1-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround
Unresolved product id: AppStream-8.2.0.Z.EUS:ruby:2.6:8020020220201131207:4cda2c84:rubygems-devel-0:3.0.3.1-107.module+el8.2.0+14086+86d863af.noarch	—	Workaround

Threats

Impact Important

CVE-2021-28965

A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using REXML and writing parsed data back to a new XML document results in creating a document with a different structure. This issue could affect the integrity of processed data in applications using REXML that parse XML documents, write data back to XML, and re-parse them again.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-611 - Improper Restriction of XML External Entity Reference

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2021-31799

An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious Ruby source code could lead to execution of arbitrary commands with the privileges of the user running rdoc.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2021-31810

Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from systems not accessible from the FTP server.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2021-32066

Ruby's Net::IMAP module did not raise an exception when receiving an unexpected response to the STARTTLS command and the connection was not upgraded to use TLS. A man-in-the-middle attacker could use this flaw to prevent Ruby applications using Net::IMAP to enable TLS encryption for a connection to an IMAP server and subsequently eavesdrop on or modify data sent over the plain text connection.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-319 - Cleartext Transmission of Sensitive Information

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2021-41817

A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service (ReDoS) during the parsing of dates. This flaw allows an attacker to hang a ruby application by providing a specially crafted date string. The highest threat to this vulnerability is system availability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

CVE-2021-41819

A flaw was found in Ruby. RubyGems cgi gem could allow a remote attacker to conduct spoofing attacks caused by the mishandling of security prefixes in cookie names in the CGI::Cookie.parse function. By sending a specially-crafted request, an attacker could perform cookie prefix spoofing attacks.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Fixed 143 products, the same list as for CVE-2019-15845

Threats

Impact Moderate

References

85 references

URL	Category
https://access.redhat.com/errata/RHSA-2022:0582	self
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/articles/6206172	external
https://bugzilla.redhat.com/show_bug.cgi?id=1773728	external
https://bugzilla.redhat.com/show_bug.cgi?id=1789407	external
https://bugzilla.redhat.com/show_bug.cgi?id=1789556	external
https://bugzilla.redhat.com/show_bug.cgi?id=1793683	external
https://bugzilla.redhat.com/show_bug.cgi?id=1827500	external
https://bugzilla.redhat.com/show_bug.cgi?id=1833291	external
https://bugzilla.redhat.com/show_bug.cgi?id=1883623	external
https://bugzilla.redhat.com/show_bug.cgi?id=1947526	external
https://bugzilla.redhat.com/show_bug.cgi?id=1958999	external
https://bugzilla.redhat.com/show_bug.cgi?id=1980126	external
https://bugzilla.redhat.com/show_bug.cgi?id=1980128	external
https://bugzilla.redhat.com/show_bug.cgi?id=1980132	external
https://bugzilla.redhat.com/show_bug.cgi?id=2025104	external
https://bugzilla.redhat.com/show_bug.cgi?id=2026757	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2019-15845	self
https://bugzilla.redhat.com/show_bug.cgi?id=1789407	external
https://www.cve.org/CVERecord?id=CVE-2019-15845	external
https://nvd.nist.gov/vuln/detail/CVE-2019-15845	external
https://www.ruby-lang.org/en/news/2019/10/01/nul-…	external
https://access.redhat.com/security/cve/CVE-2019-16201	self
https://bugzilla.redhat.com/show_bug.cgi?id=1773728	external
https://www.cve.org/CVERecord?id=CVE-2019-16201	external
https://nvd.nist.gov/vuln/detail/CVE-2019-16201	external
https://www.ruby-lang.org/en/news/2019/10/01/webr…	external
https://access.redhat.com/security/cve/CVE-2019-16254	self
https://bugzilla.redhat.com/show_bug.cgi?id=1789556	external
https://www.cve.org/CVERecord?id=CVE-2019-16254	external
https://nvd.nist.gov/vuln/detail/CVE-2019-16254	external
https://access.redhat.com/security/cve/CVE-2019-16255	self
https://bugzilla.redhat.com/show_bug.cgi?id=1793683	external
https://www.cve.org/CVERecord?id=CVE-2019-16255	external
https://nvd.nist.gov/vuln/detail/CVE-2019-16255	external
https://access.redhat.com/security/cve/CVE-2020-10663	self
https://bugzilla.redhat.com/show_bug.cgi?id=1827500	external
https://www.cve.org/CVERecord?id=CVE-2020-10663	external
https://nvd.nist.gov/vuln/detail/CVE-2020-10663	external
https://www.ruby-lang.org/en/news/2020/03/19/json…	external
https://access.redhat.com/security/cve/CVE-2020-10933	self
https://bugzilla.redhat.com/show_bug.cgi?id=1833291	external
https://www.cve.org/CVERecord?id=CVE-2020-10933	external
https://nvd.nist.gov/vuln/detail/CVE-2020-10933	external
https://www.ruby-lang.org/en/news/2020/03/31/heap…	external
https://access.redhat.com/security/cve/CVE-2020-25613	self
https://bugzilla.redhat.com/show_bug.cgi?id=1883623	external
https://www.cve.org/CVERecord?id=CVE-2020-25613	external
https://nvd.nist.gov/vuln/detail/CVE-2020-25613	external
https://www.ruby-lang.org/en/news/2020/09/29/http…	external
https://access.redhat.com/security/cve/CVE-2020-36327	self
https://bugzilla.redhat.com/show_bug.cgi?id=1958999	external
https://www.cve.org/CVERecord?id=CVE-2020-36327	external
https://nvd.nist.gov/vuln/detail/CVE-2020-36327	external
https://access.redhat.com/articles/6206172	external
https://www.zofrex.com/blog/2021/04/29/bundler-st…	external
https://access.redhat.com/security/cve/CVE-2021-28965	self
https://bugzilla.redhat.com/show_bug.cgi?id=1947526	external
https://www.cve.org/CVERecord?id=CVE-2021-28965	external
https://nvd.nist.gov/vuln/detail/CVE-2021-28965	external
https://access.redhat.com/security/cve/CVE-2021-31799	self
https://bugzilla.redhat.com/show_bug.cgi?id=1980132	external
https://www.cve.org/CVERecord?id=CVE-2021-31799	external
https://nvd.nist.gov/vuln/detail/CVE-2021-31799	external
https://www.ruby-lang.org/en/news/2021/05/02/os-c…	external
https://access.redhat.com/security/cve/CVE-2021-31810	self
https://bugzilla.redhat.com/show_bug.cgi?id=1980126	external
https://www.cve.org/CVERecord?id=CVE-2021-31810	external
https://nvd.nist.gov/vuln/detail/CVE-2021-31810	external
https://www.ruby-lang.org/en/news/2021/07/07/trus…	external
https://access.redhat.com/security/cve/CVE-2021-32066	self
https://bugzilla.redhat.com/show_bug.cgi?id=1980128	external
https://www.cve.org/CVERecord?id=CVE-2021-32066	external
https://nvd.nist.gov/vuln/detail/CVE-2021-32066	external
https://www.ruby-lang.org/en/news/2021/07/07/star…	external
https://access.redhat.com/security/cve/CVE-2021-41817	self
https://bugzilla.redhat.com/show_bug.cgi?id=2025104	external
https://www.cve.org/CVERecord?id=CVE-2021-41817	external
https://nvd.nist.gov/vuln/detail/CVE-2021-41817	external
https://www.ruby-lang.org/en/news/2021/11/15/date…	external
https://access.redhat.com/security/cve/CVE-2021-41819	self
https://bugzilla.redhat.com/show_bug.cgi?id=2026757	external
https://www.cve.org/CVERecord?id=CVE-2021-41819	external
https://nvd.nist.gov/vuln/detail/CVE-2021-41819	external

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2019-15845 (GCVE-0-2019-15845)

Vulnerability from cvelistv5 – Published: 2019-11-26 16:45 – Updated: 2024-08-05 01:03

Summary

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

9 references

URL	Tags
https://hackerone.com/reports/449617	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
https://usn.ubuntu.com/4201-1/	vendor-advisoryx_refsource_UBUNTU
https://seclists.org/bugtraq/2019/Dec/31	mailing-listx_refsource_BUGTRAQ
https://seclists.org/bugtraq/2019/Dec/32	mailing-listx_refsource_BUGTRAQ
https://www.debian.org/security/2019/dsa-4587	vendor-advisoryx_refsource_DEBIAN
https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
https://security.gentoo.org/glsa/202003-06	vendor-advisoryx_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:03:32.086Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/449617"
          },
          {
            "name": "[debian-lts-announce] 20191125 [SECURITY] [DLA 2007-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
          },
          {
            "name": "USN-4201-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4201-1/"
          },
          {
            "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/31"
          },
          {
            "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/32"
          },
          {
            "name": "DSA-4587",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4587"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "GLSA-202003-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-06"
          },
          {
            "name": "openSUSE-SU-2020:0395",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-29T00:06:02.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/449617"
        },
        {
          "name": "[debian-lts-announce] 20191125 [SECURITY] [DLA 2007-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
        },
        {
          "name": "USN-4201-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4201-1/"
        },
        {
          "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/31"
        },
        {
          "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/32"
        },
        {
          "name": "DSA-4587",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4587"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "GLSA-202003-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-06"
        },
        {
          "name": "openSUSE-SU-2020:0395",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-15845",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/449617",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/449617"
            },
            {
              "name": "[debian-lts-announce] 20191125 [SECURITY] [DLA 2007-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
            },
            {
              "name": "USN-4201-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4201-1/"
            },
            {
              "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Dec/31"
            },
            {
              "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Dec/32"
            },
            {
              "name": "DSA-4587",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4587"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "GLSA-202003-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-06"
            },
            {
              "name": "openSUSE-SU-2020:0395",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-15845",
    "datePublished": "2019-11-26T16:45:08.000Z",
    "dateReserved": "2019-08-30T00:00:00.000Z",
    "dateUpdated": "2024-08-05T01:03:32.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-16201 (GCVE-0-2019-16201)

Vulnerability from cvelistv5 – Published: 2019-11-26 00:00 – Updated: 2024-08-05 01:10

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
https://hackerone.com/reports/661722
https://lists.debian.org/debian-lts-announce/2019…
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
https://seclists.org/bugtraq/2019/Dec/31	mailing-list
https://seclists.org/bugtraq/2019/Dec/32	mailing-list
https://www.debian.org/security/2019/dsa-4587	vendor-advisory
https://www.oracle.com/security-alerts/cpujan2020.html
https://security.gentoo.org/glsa/202003-06	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2020…	mailing-list
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:10:41.604Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/661722"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
          },
          {
            "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
          },
          {
            "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/31"
          },
          {
            "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/32"
          },
          {
            "name": "DSA-4587",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4587"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "GLSA-202003-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-06"
          },
          {
            "name": "openSUSE-SU-2020:0395",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
          },
          {
            "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-30T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/661722"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
        },
        {
          "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
        },
        {
          "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/31"
        },
        {
          "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/32"
        },
        {
          "name": "DSA-4587",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4587"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "GLSA-202003-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202003-06"
        },
        {
          "name": "openSUSE-SU-2020:0395",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
        },
        {
          "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-16201",
    "datePublished": "2019-11-26T00:00:00.000Z",
    "dateReserved": "2019-09-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T01:10:41.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-16254 (GCVE-0-2019-16254)

Vulnerability from cvelistv5 – Published: 2019-11-26 00:00 – Updated: 2024-08-05 01:10

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

16 references

URL	Tags
https://hackerone.com/reports/331984
https://lists.debian.org/debian-lts-announce/2019…
https://www.ruby-lang.org/ja/news/2019/10/01/http…
https://www.ruby-lang.org/ja/news/2019/10/01/ruby…
https://www.ruby-lang.org/ja/news/2019/10/01/ruby…
https://www.ruby-lang.org/ja/news/2019/10/01/ruby…
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
https://seclists.org/bugtraq/2019/Dec/31	mailing-list
https://seclists.org/bugtraq/2019/Dec/32	mailing-list
https://www.debian.org/security/2019/dsa-4587	vendor-advisory
https://www.debian.org/security/2019/dsa-4586	vendor-advisory
https://www.oracle.com/security-alerts/cpujan2020.html
https://security.gentoo.org/glsa/202003-06	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2020…	mailing-list
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:10:41.699Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/331984"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/"
          },
          {
            "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
          },
          {
            "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/31"
          },
          {
            "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/32"
          },
          {
            "name": "DSA-4587",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4587"
          },
          {
            "name": "DSA-4586",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4586"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "GLSA-202003-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-06"
          },
          {
            "name": "openSUSE-SU-2020:0395",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
          },
          {
            "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-30T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/331984"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
        },
        {
          "url": "https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/"
        },
        {
          "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/"
        },
        {
          "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/"
        },
        {
          "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/"
        },
        {
          "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
        },
        {
          "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/31"
        },
        {
          "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/32"
        },
        {
          "name": "DSA-4587",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4587"
        },
        {
          "name": "DSA-4586",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4586"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "GLSA-202003-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202003-06"
        },
        {
          "name": "openSUSE-SU-2020:0395",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
        },
        {
          "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-16254",
    "datePublished": "2019-11-26T00:00:00.000Z",
    "dateReserved": "2019-09-11T00:00:00.000Z",
    "dateUpdated": "2024-08-05T01:10:41.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-16255 (GCVE-0-2019-16255)

Vulnerability from cvelistv5 – Published: 2019-11-26 00:00 – Updated: 2024-08-05 01:10

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

15 references

URL	Tags
https://hackerone.com/reports/327512
https://lists.debian.org/debian-lts-announce/2019…
https://www.ruby-lang.org/ja/news/2019/10/01/ruby…
https://www.ruby-lang.org/ja/news/2019/10/01/ruby…
https://www.ruby-lang.org/ja/news/2019/10/01/ruby…
https://www.ruby-lang.org/ja/news/2019/10/01/code…
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
https://seclists.org/bugtraq/2019/Dec/31	mailing-list
https://seclists.org/bugtraq/2019/Dec/32	mailing-list
https://www.debian.org/security/2019/dsa-4587	vendor-advisory
https://www.oracle.com/security-alerts/cpujan2020.html
https://security.gentoo.org/glsa/202003-06	vendor-advisory
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2020…	mailing-list
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:10:41.667Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/327512"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/ja/news/2019/10/01/code-injection-shell-test-cve-2019-16255/"
          },
          {
            "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
          },
          {
            "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/31"
          },
          {
            "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/32"
          },
          {
            "name": "DSA-4587",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4587"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "GLSA-202003-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-06"
          },
          {
            "name": "openSUSE-SU-2020:0395",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
          },
          {
            "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the \"command\" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-30T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/327512"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html"
        },
        {
          "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/"
        },
        {
          "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/"
        },
        {
          "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/"
        },
        {
          "url": "https://www.ruby-lang.org/ja/news/2019/10/01/code-injection-shell-test-cve-2019-16255/"
        },
        {
          "name": "[debian-lts-announce] 20191210 [SECURITY] [DLA 2027-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html"
        },
        {
          "name": "20191217 [SECURITY] [DSA 4587-1] ruby2.3 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/31"
        },
        {
          "name": "20191217 [SECURITY] [DSA 4586-1] ruby2.5 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/32"
        },
        {
          "name": "DSA-4587",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4587"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "GLSA-202003-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202003-06"
        },
        {
          "name": "openSUSE-SU-2020:0395",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html"
        },
        {
          "name": "[debian-lts-announce] 20200816 [SECURITY] [DLA 2330-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-16255",
    "datePublished": "2019-11-26T00:00:00.000Z",
    "dateReserved": "2019-09-11T00:00:00.000Z",
    "dateUpdated": "2024-08-05T01:10:41.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10663 (GCVE-0-2020-10663)

Vulnerability from cvelistv5 – Published: 2020-04-28 20:58 – Updated: 2024-08-04 11:06

Summary

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

19 references

URL	Tags
https://www.ruby-lang.org/en/news/2020/03/19/json…	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://www.debian.org/security/2020/dsa-4721	vendor-advisoryx_refsource_DEBIAN
https://lists.apache.org/thread.html/r8d2e174230f…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rd9b9cc843f5…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ree3abcd33c0…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb023d54a46d…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rb2b98191244…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r5f17bfca1d6…	mailing-listx_refsource_MLIST
https://support.apple.com/kb/HT211931	x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2020/Dec/32	mailing-listx_refsource_FULLDISC
https://lists.apache.org/thread.html/rec8bb4d637b…	mailing-listx_refsource_MLIST
https://security.netapp.com/advisory/ntap-2021012…	x_refsource_CONFIRM
https://lists.apache.org/thread.html/r37c0e1807da…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r3b04f4e99a1…	mailing-listx_refsource_MLIST

Date Public

2020-03-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:10.608Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/"
          },
          {
            "name": "[debian-lts-announce] 20200430 [SECURITY] [DLA 2192-1] ruby2.1 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html"
          },
          {
            "name": "openSUSE-SU-2020:0586",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html"
          },
          {
            "name": "FEDORA-2020-26df92331a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/"
          },
          {
            "name": "FEDORA-2020-d171bf636d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/"
          },
          {
            "name": "FEDORA-2020-a95706b117",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/"
          },
          {
            "name": "DSA-4721",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4721"
          },
          {
            "name": "[zookeeper-dev] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200913 [jira] [Resolved] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200930 [jira] [Comment Edited] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200930 [jira] [Commented] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20200930 [jira] [Issue Comment Deleted] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT211931"
          },
          {
            "name": "20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2020/Dec/32"
          },
          {
            "name": "[zookeeper-issues] 20210106 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210129-0003/"
          },
          {
            "name": "[zookeeper-issues] 20210404 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20210404 [jira] [Assigned] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2020-03-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-04T06:07:02.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/"
        },
        {
          "name": "[debian-lts-announce] 20200430 [SECURITY] [DLA 2192-1] ruby2.1 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html"
        },
        {
          "name": "openSUSE-SU-2020:0586",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html"
        },
        {
          "name": "FEDORA-2020-26df92331a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/"
        },
        {
          "name": "FEDORA-2020-d171bf636d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/"
        },
        {
          "name": "FEDORA-2020-a95706b117",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/"
        },
        {
          "name": "DSA-4721",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4721"
        },
        {
          "name": "[zookeeper-dev] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200913 [jira] [Resolved] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200930 [jira] [Comment Edited] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200930 [jira] [Commented] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20200930 [jira] [Issue Comment Deleted] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT211931"
        },
        {
          "name": "20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2020/Dec/32"
        },
        {
          "name": "[zookeeper-issues] 20210106 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210129-0003/"
        },
        {
          "name": "[zookeeper-issues] 20210404 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E"
        },
        {
          "name": "[zookeeper-issues] 20210404 [jira] [Assigned] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-10663",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/"
            },
            {
              "name": "[debian-lts-announce] 20200430 [SECURITY] [DLA 2192-1] ruby2.1 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00030.html"
            },
            {
              "name": "openSUSE-SU-2020:0586",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.html"
            },
            {
              "name": "FEDORA-2020-26df92331a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/"
            },
            {
              "name": "FEDORA-2020-d171bf636d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/"
            },
            {
              "name": "FEDORA-2020-a95706b117",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/"
            },
            {
              "name": "DSA-4721",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4721"
            },
            {
              "name": "[zookeeper-dev] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200913 [jira] [Resolved] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200930 [jira] [Comment Edited] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200930 [jira] [Commented] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20200930 [jira] [Issue Comment Deleted] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "https://support.apple.com/kb/HT211931",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT211931"
            },
            {
              "name": "20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2020/Dec/32"
            },
            {
              "name": "[zookeeper-issues] 20210106 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210129-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210129-0003/"
            },
            {
              "name": "[zookeeper-issues] 20210404 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20210404 [jira] [Assigned] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61@%3Cissues.zookeeper.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-10663",
    "datePublished": "2020-04-28T20:58:30.000Z",
    "dateReserved": "2020-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:06:10.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-10933 (GCVE-0-2020-10933)

Vulnerability from cvelistv5 – Published: 2020-05-04 14:54 – Updated: 2024-08-04 11:21

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

4 references

URL	Tags
https://www.ruby-lang.org/en/news/2020/03/31/heap…	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.netapp.com/advisory/ntap-2020062…	x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4721	vendor-advisoryx_refsource_DEBIAN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:21:13.597Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/"
          },
          {
            "name": "FEDORA-2020-a95706b117",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200625-0001/"
          },
          {
            "name": "DSA-4721",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4721"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-08T23:06:16.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/"
        },
        {
          "name": "FEDORA-2020-a95706b117",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200625-0001/"
        },
        {
          "name": "DSA-4721",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4721"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-10933",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/"
            },
            {
              "name": "FEDORA-2020-a95706b117",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200625-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200625-0001/"
            },
            {
              "name": "DSA-4721",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4721"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-10933",
    "datePublished": "2020-05-04T14:54:00.000Z",
    "dateReserved": "2020-03-24T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:21:13.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25613 (GCVE-0-2020-25613)

Vulnerability from cvelistv5 – Published: 2020-10-06 00:00 – Updated: 2024-08-04 15:33

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

8 references

URL	Tags
https://hackerone.com/reports/965267
https://www.ruby-lang.org/en/news/2020/09/29/http…
https://github.com/ruby/webrick/commit/8946bb38b4…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://security.netapp.com/advisory/ntap-2021011…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202401-27	vendor-advisory

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:33:05.751Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/965267"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7"
          },
          {
            "name": "FEDORA-2020-02ca18c2a0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ/"
          },
          {
            "name": "FEDORA-2020-fe2a7d7390",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210115-0008/"
          },
          {
            "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
          },
          {
            "name": "GLSA-202401-27",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-27"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-24T05:06:30.204Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/965267"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/"
        },
        {
          "url": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7"
        },
        {
          "name": "FEDORA-2020-02ca18c2a0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ/"
        },
        {
          "name": "FEDORA-2020-fe2a7d7390",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210115-0008/"
        },
        {
          "name": "[debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"
        },
        {
          "name": "GLSA-202401-27",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-27"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-25613",
    "datePublished": "2020-10-06T00:00:00.000Z",
    "dateReserved": "2020-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:33:05.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-36327 (GCVE-0-2020-36327)

Vulnerability from cvelistv5 – Published: 2021-04-29 02:28 – Updated: 2024-08-04 17:23

Summary

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://github.com/rubygems/rubygems/issues/3982	x_refsource_MISC
https://msrc.microsoft.com/update-guide/en-US/vul…	x_refsource_MISC
https://bundler.io/blog/2021/02/15/a-more-secure-…	x_refsource_MISC
https://mensfeld.pl/2021/02/rubygems-dependency-c…	x_refsource_MISC
https://www.zofrex.com/blog/2021/04/29/bundler-st…	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:23:10.451Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rubygems/rubygems/issues/3982"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/"
          },
          {
            "name": "FEDORA-2021-36cdab1f8d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every \"Dependency Confusion\" issue in every product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-29T02:06:19.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rubygems/rubygems/issues/3982"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/"
        },
        {
          "name": "FEDORA-2021-36cdab1f8d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-36327",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every \"Dependency Confusion\" issue in every product."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rubygems/rubygems/issues/3982",
              "refsource": "MISC",
              "url": "https://github.com/rubygems/rubygems/issues/3982"
            },
            {
              "name": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105",
              "refsource": "MISC",
              "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105"
            },
            {
              "name": "https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html",
              "refsource": "MISC",
              "url": "https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html"
            },
            {
              "name": "https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/",
              "refsource": "MISC",
              "url": "https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/"
            },
            {
              "name": "https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/",
              "refsource": "MISC",
              "url": "https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/"
            },
            {
              "name": "FEDORA-2021-36cdab1f8d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-36327",
    "datePublished": "2021-04-29T02:28:54.000Z",
    "dateReserved": "2021-04-29T00:00:00.000Z",
    "dateUpdated": "2024-08-04T17:23:10.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-28965 (GCVE-0-2021-28965)

Vulnerability from cvelistv5 – Published: 2021-04-21 06:55 – Updated: 2024-08-03 21:55

Summary

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

3 references

URL	Tags
https://www.ruby-lang.org/en/news/2021/04/05/xml-…	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.netapp.com/advisory/ntap-2021052…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:55:12.192Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/"
          },
          {
            "name": "FEDORA-2021-7b8b65bc7a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210528-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-28T09:06:18.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/"
        },
        {
          "name": "FEDORA-2021-7b8b65bc7a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210528-0003/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-28965",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/",
              "refsource": "MISC",
              "url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/"
            },
            {
              "name": "FEDORA-2021-7b8b65bc7a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210528-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210528-0003/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-28965",
    "datePublished": "2021-04-21T06:55:24.000Z",
    "dateReserved": "2021-03-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T21:55:12.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-31799 (GCVE-0-2021-31799)

Vulnerability from cvelistv5 – Published: 2021-07-29 00:00 – Updated: 2024-10-15 20:28

Summary

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:16 UTC

CWE

n/a
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

mitre mitre root

References

6 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.ruby-lang.org/en/news/2021/05/02/os-c…
https://security-tracker.debian.org/tracker/CVE-2…
https://security.netapp.com/advisory/ntap-2021090…
https://security.gentoo.org/glsa/202401-05	vendor-advisory

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:10:29.996Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20211013 [SECURITY] [DLA 2780-1] ruby2.3 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2021-31799"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210902-0004/"
          },
          {
            "name": "GLSA-202401-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-31799",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:16:06.341905Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T20:28:31.276Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-05T14:06:20.190Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20211013 [SECURITY] [DLA 2780-1] ruby2.3 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/CVE-2021-31799"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210902-0004/"
        },
        {
          "name": "GLSA-202401-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-05"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-31799",
    "datePublished": "2021-07-29T00:00:00.000Z",
    "dateReserved": "2021-04-25T00:00:00.000Z",
    "dateUpdated": "2024-10-15T20:28:31.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2022_0582

CVE-2019-15845 (GCVE-0-2019-15845)

CVE-2019-16201 (GCVE-0-2019-16201)

CVE-2019-16254 (GCVE-0-2019-16254)

CVE-2019-16255 (GCVE-0-2019-16255)

CVE-2020-10663 (GCVE-0-2020-10663)

CVE-2020-10933 (GCVE-0-2020-10933)

CVE-2020-25613 (GCVE-0-2020-25613)

CVE-2020-36327 (GCVE-0-2020-36327)

CVE-2021-28965 (GCVE-0-2021-28965)

CVE-2021-31799 (GCVE-0-2021-31799)

Tags

Sightings

Nomenclature