Vulmon
Amazon Linux AMI Security Advisory: ALAS-2018-1113
Advisory Release Date: 2018-12-06 00:31 Pacific
Advisory Updated Date: 2018-12-14 19:27 Pacific
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.(CVE-2018-16395)
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.(CVE-2018-16396)
Affected Packages:
ruby23, ruby24
Issue Correction:
Run yum update ruby23 to update your system.
i686:
ruby23-devel-2.3.8-1.20.amzn1.i686
ruby23-libs-2.3.8-1.20.amzn1.i686
rubygem23-io-console-0.4.5-1.20.amzn1.i686
ruby23-2.3.8-1.20.amzn1.i686
rubygem23-json-1.8.3.1-1.20.amzn1.i686
rubygem23-psych-2.1.0.1-1.20.amzn1.i686
rubygem23-bigdecimal-1.2.8-1.20.amzn1.i686
ruby23-debuginfo-2.3.8-1.20.amzn1.i686
ruby24-libs-2.4.5-1.30.7.amzn1.i686
rubygem24-json-2.0.4-1.30.7.amzn1.i686
ruby24-2.4.5-1.30.7.amzn1.i686
ruby24-devel-2.4.5-1.30.7.amzn1.i686
rubygem24-xmlrpc-0.2.1-1.30.7.amzn1.i686
rubygem24-bigdecimal-1.3.2-1.30.7.amzn1.i686
ruby24-debuginfo-2.4.5-1.30.7.amzn1.i686
rubygem24-psych-2.2.2-1.30.7.amzn1.i686
rubygem24-io-console-0.4.6-1.30.7.amzn1.i686
noarch:
ruby23-doc-2.3.8-1.20.amzn1.noarch
rubygem23-did_you_mean-1.0.0-1.20.amzn1.noarch
rubygems23-2.5.2.3-1.20.amzn1.noarch
ruby23-irb-2.3.8-1.20.amzn1.noarch
rubygems23-devel-2.5.2.3-1.20.amzn1.noarch
rubygems24-devel-2.6.14.3-1.30.7.amzn1.noarch
rubygem24-did_you_mean-1.1.0-1.30.7.amzn1.noarch
rubygems24-2.6.14.3-1.30.7.amzn1.noarch
ruby24-irb-2.4.5-1.30.7.amzn1.noarch
ruby24-doc-2.4.5-1.30.7.amzn1.noarch
src:
ruby23-2.3.8-1.20.amzn1.src
ruby24-2.4.5-1.30.7.amzn1.src
x86_64:
ruby23-devel-2.3.8-1.20.amzn1.x86_64
ruby23-libs-2.3.8-1.20.amzn1.x86_64
rubygem23-bigdecimal-1.2.8-1.20.amzn1.x86_64
rubygem23-io-console-0.4.5-1.20.amzn1.x86_64
rubygem23-psych-2.1.0.1-1.20.amzn1.x86_64
rubygem23-json-1.8.3.1-1.20.amzn1.x86_64
ruby23-debuginfo-2.3.8-1.20.amzn1.x86_64
ruby23-2.3.8-1.20.amzn1.x86_64
ruby24-libs-2.4.5-1.30.7.amzn1.x86_64
rubygem24-xmlrpc-0.2.1-1.30.7.amzn1.x86_64
ruby24-debuginfo-2.4.5-1.30.7.amzn1.x86_64
ruby24-devel-2.4.5-1.30.7.amzn1.x86_64
rubygem24-io-console-0.4.6-1.30.7.amzn1.x86_64
rubygem24-bigdecimal-1.3.2-1.30.7.amzn1.x86_64
rubygem24-psych-2.2.2-1.30.7.amzn1.x86_64
rubygem24-json-2.0.4-1.30.7.amzn1.x86_64
ruby24-2.4.5-1.30.7.amzn1.x86_64