Vulmon
Amazon Linux 2 Security Advisory: ALASRUBY3.0-2023-005
Advisory Release Date: 2023-08-21 20:59 Pacific
Advisory Updated Date: 2023-09-25 22:01 Pacific
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." (CVE-2021-32066)
Affected Packages:
ruby
Issue Correction:
Run yum update ruby to update your system.
aarch64:
ruby-3.0.2-149.amzn2.aarch64
ruby-devel-3.0.2-149.amzn2.aarch64
ruby-libs-3.0.2-149.amzn2.aarch64
rubygem-bigdecimal-3.0.0-149.amzn2.aarch64
rubygem-io-console-0.5.7-149.amzn2.aarch64
rubygem-json-2.5.1-149.amzn2.aarch64
rubygem-psych-3.3.0-149.amzn2.aarch64
ruby-debuginfo-3.0.2-149.amzn2.aarch64
noarch:
rubygems-3.2.22-149.amzn2.noarch
rubygems-devel-3.2.22-149.amzn2.noarch
ruby-default-gems-3.0.2-149.amzn2.noarch
rubygem-irb-1.3.5-149.amzn2.noarch
rubygem-rdoc-6.3.1-149.amzn2.noarch
ruby-doc-3.0.2-149.amzn2.noarch
rubygem-bundler-2.2.22-149.amzn2.noarch
rubygem-minitest-5.14.2-149.amzn2.noarch
rubygem-power_assert-1.2.0-149.amzn2.noarch
rubygem-rake-13.0.3-149.amzn2.noarch
rubygem-rbs-1.0.4-149.amzn2.noarch
rubygem-test-unit-3.3.7-149.amzn2.noarch
rubygem-rexml-3.2.5-149.amzn2.noarch
rubygem-rss-0.2.9-149.amzn2.noarch
rubygem-typeprof-0.12.0-149.amzn2.noarch
src:
ruby-3.0.2-149.amzn2.src
x86_64:
ruby-3.0.2-149.amzn2.x86_64
ruby-devel-3.0.2-149.amzn2.x86_64
ruby-libs-3.0.2-149.amzn2.x86_64
rubygem-bigdecimal-3.0.0-149.amzn2.x86_64
rubygem-io-console-0.5.7-149.amzn2.x86_64
rubygem-json-2.5.1-149.amzn2.x86_64
rubygem-psych-3.3.0-149.amzn2.x86_64
ruby-debuginfo-3.0.2-149.amzn2.x86_64