RHSA-2021:2587MediumCVSS 8.1

Red Hat Security Advisory: ruby:2.5 security, bug fix, and enhancement update

Published
June 29, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (8)

CVE-2021-28965 →CVE-2019-15845 →CVE-2019-16201 →CVE-2019-16254 →CVE-2019-16255 →CVE-2020-10663 →CVE-2020-10933 →CVE-2020-25613 →

📋 Description

CVE-2019-15845 — ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? CVE-2019-16201 — ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication CVE-2019-16254 — ruby: HTTP response splitting in WEBrick CVE-2019-16255 — ruby: Code injection via command argument of Shell#test / Shell#[] CVE-2020-10663 — rubygem-json: Unsafe object creation vulnerability in JSON CVE-2020-10933 — ruby: BasicSocket#read_nonblock method leads to information disclosure CVE-2020-25613 — ruby: Potential HTTP request smuggling in WEBrick CVE-2021-28965 — ruby: XML round-trip vulnerability in REXML

🎯 Affected products145

  • Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.aarch64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.i686 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.ppc64le (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.s390x (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.src (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.x86_64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debuginfo-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.aarch64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debuginfo-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.i686 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debuginfo-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.ppc64le (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debuginfo-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.s390x (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debuginfo-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.x86_64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debugsource-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.aarch64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debugsource-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.i686 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debugsource-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.ppc64le (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debugsource-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.s390x (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-debugsource-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.x86_64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-devel-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.aarch64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-devel-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.i686 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-devel-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.ppc64le (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-devel-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.s390x (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-devel-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.x86_64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-doc-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.noarch (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-irb-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.noarch (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-libs-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.aarch64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-libs-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.i686 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-libs-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.ppc64le (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-libs-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.s390x (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-libs-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.x86_64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • ruby-libs-debuginfo-0:2.5.9-107.module+el8.4.0+10822+fe4fffb1.aarch64 (ruby:2.5) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +115 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: It is possible to test for presence of the NULL byte manually prior to call the affected methods with an untrusted string. Workaround: To mitigate this vulnerability, do not supply untrusted user input and/or untrusted strings to the following method calls or utilize code libraries which do so: ``` JSON(user_input) JSON[user_input, nil] JSON.parse(user_input, nil) JSON::Parser.new(user_input).parse ``` Also note that JSON.load() should never be given input from unknown sources.

🔗 References (13)