Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Ruby allows denial-of-service and cookie spoofing
published 4 years ago
Summary
The Ruby packages for AlmaLinux can be tricked into hanging when processing certain date strings, which could slow down or stop your applications. They also let attackers forge cookie data, potentially bypassing security checks. Update the Ruby packages from AlmaLinux to the latest versions to remove these risks.
What to do
- Update almalinux ruby to version 2.5.9-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux ruby-devel to version 2.5.9-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux ruby-doc to version 2.5.9-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux ruby-irb to version 2.5.9-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux ruby-libs to version 2.5.9-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-abrt to version 0.3.0-4.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-abrt-doc to version 0.3.0-4.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-bigdecimal to version 1.3.4-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-bson to version 4.3.0-2.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-bson to version 4.3.0-2.module_el8.5.0+259+8cec6917.
- Update almalinux rubygem-bson-doc to version 4.3.0-2.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-bundler to version 1.16.1-4.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-bundler-doc to version 1.16.1-4.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-did_you_mean to version 1.2.0-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-io-console to version 0.4.6-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-json to version 2.1.0-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-minitest to version 5.10.3-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-mongo to version 2.5.1-2.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-mongo-doc to version 2.5.1-2.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-mysql2 to version 0.4.10-4.module_el8.5.0+259+8cec6917.
- Update almalinux rubygem-mysql2 to version 0.4.10-4.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-mysql2-doc to version 0.4.10-4.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-net-telnet to version 0.1.1-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-openssl to version 2.1.2-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-pg to version 1.0.0-2.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-pg to version 1.0.0-2.module_el8.5.0+259+8cec6917.
- Update almalinux rubygem-pg-doc to version 1.0.0-2.module_el8.5.0+2625+ec418553.
- Update almalinux rubygem-power_assert to version 1.1.1-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-psych to version 3.0.2-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-rake to version 12.3.3-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-rdoc to version 6.0.1.1-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-test-unit to version 3.2.7-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygem-xmlrpc to version 0.3.0-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygems to version 2.7.6.3-110.module_el8.6.0+3074+4b08f9d4.
- Update almalinux rubygems-devel to version 2.7.6.3-110.module_el8.6.0+3074+4b08f9d4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | ruby |
< 2.5.9-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.5.9-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | ruby-devel |
< 2.5.9-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.5.9-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | ruby-doc |
< 2.5.9-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.5.9-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | ruby-irb |
< 2.5.9-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.5.9-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | ruby-libs |
< 2.5.9-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.5.9-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-abrt |
< 0.3.0-4.module_el8.5.0+2625+ec418553 Fix: upgrade to 0.3.0-4.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-abrt-doc |
< 0.3.0-4.module_el8.5.0+2625+ec418553 Fix: upgrade to 0.3.0-4.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-bigdecimal |
< 1.3.4-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 1.3.4-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-bson |
< 4.3.0-2.module_el8.5.0+2625+ec418553 < 4.3.0-2.module_el8.5.0+259+8cec6917 Fix: upgrade to 4.3.0-2.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-bson-doc |
< 4.3.0-2.module_el8.5.0+2625+ec418553 Fix: upgrade to 4.3.0-2.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-bundler |
< 1.16.1-4.module_el8.5.0+2625+ec418553 Fix: upgrade to 1.16.1-4.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-bundler-doc |
< 1.16.1-4.module_el8.5.0+2625+ec418553 Fix: upgrade to 1.16.1-4.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-did_you_mean |
< 1.2.0-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 1.2.0-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-io-console |
< 0.4.6-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 0.4.6-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-json |
< 2.1.0-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.1.0-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-minitest |
< 5.10.3-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 5.10.3-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-mongo |
< 2.5.1-2.module_el8.5.0+2625+ec418553 Fix: upgrade to 2.5.1-2.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-mongo-doc |
< 2.5.1-2.module_el8.5.0+2625+ec418553 Fix: upgrade to 2.5.1-2.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-mysql2 |
< 0.4.10-4.module_el8.5.0+259+8cec6917 < 0.4.10-4.module_el8.5.0+2625+ec418553 Fix: upgrade to 0.4.10-4.module_el8.5.0+259+8cec6917
|
| AlmaLinux:8 | almalinux | rubygem-mysql2-doc |
< 0.4.10-4.module_el8.5.0+2625+ec418553 Fix: upgrade to 0.4.10-4.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-net-telnet |
< 0.1.1-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 0.1.1-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-openssl |
< 2.1.2-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.1.2-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-pg |
< 1.0.0-2.module_el8.5.0+2625+ec418553 < 1.0.0-2.module_el8.5.0+259+8cec6917 Fix: upgrade to 1.0.0-2.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-pg-doc |
< 1.0.0-2.module_el8.5.0+2625+ec418553 Fix: upgrade to 1.0.0-2.module_el8.5.0+2625+ec418553
|
| AlmaLinux:8 | almalinux | rubygem-power_assert |
< 1.1.1-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 1.1.1-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-psych |
< 3.0.2-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 3.0.2-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-rake |
< 12.3.3-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 12.3.3-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-rdoc |
< 6.0.1.1-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 6.0.1.1-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-test-unit |
< 3.2.7-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 3.2.7-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygem-xmlrpc |
< 0.3.0-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 0.3.0-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygems |
< 2.7.6.3-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.7.6.3-110.module_el8.6.0+3074+4b08f9d4
|
| AlmaLinux:8 | almalinux | rubygems-devel |
< 2.7.6.3-110.module_el8.6.0+3074+4b08f9d4 Fix: upgrade to 2.7.6.3-110.module_el8.6.0+3074+4b08f9d4
|
Original advisory text
Moderate: ruby:2.5 security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
* ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
* ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
* ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2022:5779 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2021-41817 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-41819 Third Party Advisory
- https://bugzilla.redhat.com/2025104 Third Party Advisory
- https://bugzilla.redhat.com/2026757 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2022-5779.html Vendor Advisory
Timeline
Published1 Aug 2022
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2022:5779 · OSV
Track software like this
Free during beta