RHSA-2021:2230MediumCVSS 8.1

Red Hat Security Advisory: rh-ruby26-ruby security, bug fix, and enhancement update

Published
June 3, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (9)

CVE-2019-3881 →CVE-2019-15845 →CVE-2019-16201 →CVE-2019-16254 →CVE-2019-16255 →CVE-2020-10933 →CVE-2020-25613 →CVE-2021-28965 →CVE-2020-10663 →

📋 Description

CVE-2019-3881 — rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code CVE-2019-15845 — ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? CVE-2019-16201 — ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication CVE-2019-16254 — ruby: HTTP response splitting in WEBrick CVE-2019-16255 — ruby: Code injection via command argument of Shell#test / Shell#[] CVE-2020-10663 — rubygem-json: Unsafe object creation vulnerability in JSON CVE-2020-10933 — ruby: BasicSocket#read_nonblock method leads to information disclosure CVE-2020-25613 — ruby: Potential HTTP request smuggling in WEBrick CVE-2021-28965 — ruby: XML round-trip vulnerability in REXML

🎯 Affected products108

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-ruby26-ruby-debuginfo-0:2.6.7-119.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-debuginfo-0:2.6.7-119.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-debuginfo-0:2.6.7-119.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-debuginfo-0:2.6.7-119.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-debuginfo-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-debuginfo-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-debuginfo-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-ruby26-ruby-devel-0:2.6.7-119.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-devel-0:2.6.7-119.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-devel-0:2.6.7-119.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-devel-0:2.6.7-119.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-devel-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-devel-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-devel-0:2.6.7-119.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-ruby26-ruby-doc-0:2.6.7-119.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-ruby26-ruby-doc-0:2.6.7-119.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-ruby26-ruby-doc-0:2.6.7-119.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • +78 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: It is possible to test for presence of the NULL byte manually prior to call the affected methods with an untrusted string. Workaround: To mitigate this vulnerability, do not supply untrusted user input and/or untrusted strings to the following method calls or utilize code libraries which do so: ``` JSON(user_input) JSON[user_input, nil] JSON.parse(user_input, nil) JSON::Parser.new(user_input).parse ``` Also note that JSON.load() should never be given input from unknown sources.

🔗 References (14)