ALASRUBY3.0-2023-003

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby. (CVE-2021-41816)

A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service (ReDoS) during the parsing of dates. This flaw allows an attacker to hang a ruby application by providing a specially crafted date string. The highest threat to this vulnerability is system availability. (CVE-2021-41817)

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. (CVE-2021-41819)

aarch64:
    ruby-3.0.3-154.amzn2.aarch64
    ruby-devel-3.0.3-154.amzn2.aarch64
    ruby-libs-3.0.3-154.amzn2.aarch64
    rubygem-bigdecimal-3.0.0-154.amzn2.aarch64
    rubygem-io-console-0.5.7-154.amzn2.aarch64
    rubygem-json-2.5.1-154.amzn2.aarch64
    rubygem-psych-3.3.2-154.amzn2.aarch64
    ruby-debuginfo-3.0.3-154.amzn2.aarch64

noarch:
    rubygems-3.2.32-154.amzn2.noarch
    rubygems-devel-3.2.32-154.amzn2.noarch
    ruby-default-gems-3.0.3-154.amzn2.noarch
    rubygem-irb-1.3.5-154.amzn2.noarch
    rubygem-rdoc-6.3.3-154.amzn2.noarch
    ruby-doc-3.0.3-154.amzn2.noarch
    rubygem-bundler-2.2.32-154.amzn2.noarch
    rubygem-minitest-5.14.2-154.amzn2.noarch
    rubygem-power_assert-1.2.0-154.amzn2.noarch
    rubygem-rake-13.0.3-154.amzn2.noarch
    rubygem-rbs-1.4.0-154.amzn2.noarch
    rubygem-test-unit-3.3.7-154.amzn2.noarch
    rubygem-rexml-3.2.5-154.amzn2.noarch
    rubygem-rss-0.2.9-154.amzn2.noarch
    rubygem-typeprof-0.15.2-154.amzn2.noarch

src:
    ruby-3.0.3-154.amzn2.src

x86_64:
    ruby-3.0.3-154.amzn2.x86_64
    ruby-devel-3.0.3-154.amzn2.x86_64
    ruby-libs-3.0.3-154.amzn2.x86_64
    rubygem-bigdecimal-3.0.0-154.amzn2.x86_64
    rubygem-io-console-0.5.7-154.amzn2.x86_64
    rubygem-json-2.5.1-154.amzn2.x86_64
    rubygem-psych-3.3.2-154.amzn2.x86_64
    ruby-debuginfo-3.0.3-154.amzn2.x86_64