Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Ruby may let attackers execute code
published 2 years ago
Summary
The Ruby language packages supplied by AlmaLinux—including the main Ruby package and its bundled gem collections—contain flaws that could allow an attacker to run their own programs, read private memory, or view hidden data. This could give unauthorized access or expose sensitive information on servers that run Ruby scripts. Apply the newest Ruby update from AlmaLinux right away to eliminate these risks.
What to do
- Update almalinux ruby to version 3.1.5-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux ruby-bundled-gems to version 3.1.5-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux ruby-default-gems to version 3.1.5-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux ruby-devel to version 3.1.5-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux ruby-doc to version 3.1.5-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux ruby-libs to version 3.1.5-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-abrt to version 0.4.0-1.module_el8.9.0+3746+91b8233a.
- Update almalinux rubygem-abrt-doc to version 0.4.0-1.module_el8.9.0+3746+91b8233a.
- Update almalinux rubygem-bigdecimal to version 3.1.1-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-bundler to version 2.3.27-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-io-console to version 0.5.11-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-irb to version 1.4.1-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-json to version 2.6.1-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-minitest to version 5.15.0-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-mysql2 to version 0.5.3-3.module_el8.9.0+3746+91b8233a.
- Update almalinux rubygem-mysql2-doc to version 0.5.3-3.module_el8.9.0+3746+91b8233a.
- Update almalinux rubygem-pg to version 1.3.2-1.module_el8.9.0+3746+91b8233a.
- Update almalinux rubygem-pg-doc to version 1.3.2-1.module_el8.9.0+3746+91b8233a.
- Update almalinux rubygem-power_assert to version 2.0.1-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-psych to version 4.0.4-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-rake to version 13.0.6-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-rbs to version 2.7.0-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-rdoc to version 6.4.1.1-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-rexml to version 3.2.5-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-rss to version 0.2.9-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-test-unit to version 3.5.3-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygem-typeprof to version 0.21.3-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygems to version 3.3.27-143.module_el8.10.0+3854+02eaa59a.
- Update almalinux rubygems-devel to version 3.3.27-143.module_el8.10.0+3854+02eaa59a.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | ruby |
< 3.1.5-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.1.5-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | ruby-bundled-gems |
< 3.1.5-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.1.5-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | ruby-default-gems |
< 3.1.5-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.1.5-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | ruby-devel |
< 3.1.5-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.1.5-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | ruby-doc |
< 3.1.5-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.1.5-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | ruby-libs |
< 3.1.5-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.1.5-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-abrt |
< 0.4.0-1.module_el8.9.0+3746+91b8233a Fix: upgrade to 0.4.0-1.module_el8.9.0+3746+91b8233a
|
| AlmaLinux:8 | almalinux | rubygem-abrt-doc |
< 0.4.0-1.module_el8.9.0+3746+91b8233a Fix: upgrade to 0.4.0-1.module_el8.9.0+3746+91b8233a
|
| AlmaLinux:8 | almalinux | rubygem-bigdecimal |
< 3.1.1-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.1.1-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-bundler |
< 2.3.27-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 2.3.27-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-io-console |
< 0.5.11-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 0.5.11-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-irb |
< 1.4.1-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 1.4.1-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-json |
< 2.6.1-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 2.6.1-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-minitest |
< 5.15.0-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 5.15.0-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-mysql2 |
< 0.5.3-3.module_el8.9.0+3746+91b8233a Fix: upgrade to 0.5.3-3.module_el8.9.0+3746+91b8233a
|
| AlmaLinux:8 | almalinux | rubygem-mysql2-doc |
< 0.5.3-3.module_el8.9.0+3746+91b8233a Fix: upgrade to 0.5.3-3.module_el8.9.0+3746+91b8233a
|
| AlmaLinux:8 | almalinux | rubygem-pg |
< 1.3.2-1.module_el8.9.0+3746+91b8233a Fix: upgrade to 1.3.2-1.module_el8.9.0+3746+91b8233a
|
| AlmaLinux:8 | almalinux | rubygem-pg-doc |
< 1.3.2-1.module_el8.9.0+3746+91b8233a Fix: upgrade to 1.3.2-1.module_el8.9.0+3746+91b8233a
|
| AlmaLinux:8 | almalinux | rubygem-power_assert |
< 2.0.1-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 2.0.1-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-psych |
< 4.0.4-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 4.0.4-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-rake |
< 13.0.6-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 13.0.6-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-rbs |
< 2.7.0-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 2.7.0-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-rdoc |
< 6.4.1.1-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 6.4.1.1-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-rexml |
< 3.2.5-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.2.5-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-rss |
< 0.2.9-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 0.2.9-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-test-unit |
< 3.5.3-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.5.3-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygem-typeprof |
< 0.21.3-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 0.21.3-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygems |
< 3.3.27-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.3.27-143.module_el8.10.0+3854+02eaa59a
|
| AlmaLinux:8 | almalinux | rubygems-devel |
< 3.3.27-143.module_el8.10.0+3854+02eaa59a Fix: upgrade to 3.3.27-143.module_el8.10.0+3854+02eaa59a
|
Original advisory text
Moderate: ruby:3.1 security, bug fix, and enhancement update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
* ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
* ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
* ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Security Fix(es):
* ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
* ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
* ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
References
- https://access.redhat.com/errata/RHSA-2024:3546 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-27280 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-27281 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-27282 Third Party Advisory
- https://bugzilla.redhat.com/2270749 Third Party Advisory
- https://bugzilla.redhat.com/2270750 Third Party Advisory
- https://bugzilla.redhat.com/2276810 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2024-3546.html Vendor Advisory
Timeline
Published3 Jun 2024
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2024:3546 · OSV
Track software like this
Free during beta