A vulnerability has been discovered in Ruby, possibly allowing remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 3.3.12:3.3, < 3.4.10:3.4, < 4.0.6:4.0 | >= 3.3.12:3.3, >= 3.4.10:3.4, >= 4.0.6:4.0 |
| dev-ruby/erb | * | < 6.0.6:6 | >= 6.0.6:6 |
Ruby is an interpreted scripting language for quick and easy object-oriented programming.
A vulnerability has been discovered in Ruby. Please review the CVE identifier referenced below for details.
Remote code execution is possible.
There is no known workaround at this time.
All Ruby 3.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-3.3.12:3.3"
All Ruby 3.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-3.4.10:3.4"
All Ruby 4.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-4.0.6:4.0"
All ERB users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/erb-6.0.6:6"
Multiple vulnerabilities have been discovered in Ruby, the worst of which could lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 2.5.9:2.5, < 2.6.10:2.6, < 2.7.8:2.7, < 3.0.6:3.0, < 3.1.4:3.1, < 3.2.2:3.2 | >= 3.1.4:3.1, >= 3.2.2:3.2 |
Ruby is an interpreted scripting language for quick and easy object-oriented programming. It comes bundled with a HTTP server ("WEBrick").
Multiple vulnerabilities have been discovered in Ruby. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --depclean ruby:2.5 ruby:2.6 ruby:2.7 ruby:3.0 # emerge --ask --oneshot --verbose ">=dev-lang/ruby-3.1.4:3.1" # emerge --ask --oneshot --verbose ">=dev-lang/ruby-3.2.2:3.2"
Multiple vulnerabilities have been found in Ruby, the worst of which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 2.4.9:2.4, < 2.5.7:2.5 | >= 2.4.9:2.4, >= 2.5.7:2.5 |
Ruby is an interpreted object-oriented programming language. The elaborate standard library includes an HTTP server (“WEBRick”) and a class for XML parsing (“REXML”).
Multiple vulnerabilities have been discovered in Ruby. Please review the CVE identifiers referenced below for details.
A remote attacker could execute arbitrary code, have unauthorized access by bypassing intended path matching or cause a Denial of Service condition.
There is no known workaround at this time.
All Ruby 2.4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-2.4.9:2.4"
All Ruby 2.5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-2.5.7:2.5"
A vulnerability has been found in Ruby which may allow for arbitrary command execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 2.2.9:2.2 | >= 2.2.9:2.2 |
Ruby is an interpreted object-oriented programming language. The elaborate standard library includes an HTTP server (“WEBRick”) and a class for XML parsing (“REXML”).
A command injection flaw was discovered in Net::FTP which impacts Ruby.
A remote attacker, by enticing a user to download and open a crafted file from a malicious FTP server, could execute arbitrary commands with the privileges of the process.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-2.2.9:2.2"
Multiple vulnerabilities have been found in Ruby, the worst of which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 2.2.8 | >= 2.2.8 |
Ruby is an interpreted object-oriented programming language. The elaborate standard library includes an HTTP server (“WEBRick”) and a class for XML parsing (“REXML”).
Multiple vulnerabilities have been discovered in Ruby. Please review the referenced CVE identifiers for details.
A remote attacker could execute arbitrary code, cause a Denial of Service condition, or obtain sensitive information.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-2.2.8"
Multiple vulnerabilities have been found in Ruby, allowing context-dependent attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 2.0.0_p598 | >= 1.9.3_p551 (revision), >= 2.0.0_p598 |
Ruby is an object-oriented scripting language.
Multiple vulnerabilities have been discovered in Ruby. Please review the CVE identifiers referenced below for details.
A context-dependent attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or bypass security restrictions.
There is no known workaround at this time.
All Ruby 1.9 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.9.3_p551"
All Ruby 2.0 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-2.0.0_p598"
An input sanitation flaw in the WEBrick HTTP server included in Ruby might allow remote attackers to inject arbitrary control characters into terminal sessions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.7_p249 | >= 1.8.7_p249, >= 1.8.6_p388 (revision) |
Ruby is an interpreted scripting language for quick and easy object-oriented programming. It comes bundled with a HTTP server ("WEBrick").
Giovanni Pellerano, Alessandro Tanasi and Francesco Ongaro reported that WEBrick does not filter terminal control characters, for instance when handling HTTP logs.
A remote attacker could send a specially crafted HTTP request to a WEBrick server to inject arbitrary terminal control characters, possibly resulting in the execution of arbitrary commands, data loss, or other unspecified impact. This could also be used to facilitate other attacks.
There is no known workaround at this time.
All Ruby 1.8.7 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.7_p249"
All Ruby 1.8.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.6_p388"
A flaw in the Ruby standard library might allow remote attackers to cause a Denial of Service attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.6_p369 | >= 1.8.6_p369 |
Ruby is an interpreted object-oriented programming language. The elaborate standard library includes the "BigDecimal" class.
Tadayoshi Funaba reported that BigDecimal in ext/bigdecimal/bigdecimal.c does not properly handle string arguments containing overly long numbers.
A remote attacker could exploit this issue to remotely cause a Denial of Service attack.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.6_p369"
Multiple vulnerabilities have been discovered in Ruby that allow for attacks including arbitrary code execution and Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.6_p287-r1 | >= 1.8.6_p287-r1 |
Ruby is an interpreted object-oriented programming language. The elaborate standard library includes an HTTP server ("WEBRick") and a class for XML parsing ("REXML").
Multiple vulnerabilities have been discovered in the Ruby interpreter and its standard libraries. Drew Yao of Apple Product Security discovered the following flaws:
Furthermore, several other vulnerabilities have been reported:
These vulnerabilities allow remote attackers to execute arbitrary code, spoof DNS responses, bypass Ruby's built-in security and taintness checks, and cause a Denial of Service via crash or CPU exhaustion.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.6_p287-r1"
The Ruby cgi.rb CGI library is vulnerable to a Denial of Service attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.5_p2 | >= 1.8.5_p2 |
Ruby is a dynamic, open source programming language with a focus on simplicity and productivity.
The read_multipart function of the CGI library shipped with Ruby (cgi.rb) does not properly check boundaries in MIME multipart content. This is a different issue than GLSA 200611-12.
The vulnerability can be exploited by sending the cgi.rb library a crafted HTTP request with multipart MIME encoding that contains a malformed MIME boundary specifier. Successful exploitation of the vulnerability causes the library to go into an infinite loop.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.5_p2"
The Ruby cgi.rb CGI library is vulnerable to a Denial of Service attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.5-r3 | >= 1.8.5-r3 |
Ruby is a dynamic, open source programming language with a focus on simplicity and productivity.
Zed Shaw, Jeremy Kemper, and Jamis Buck of the Mongrel project reported that the CGI library shipped with Ruby is vulnerable to a remote Denial of Service by an unauthenticated user.
The vulnerability can be exploited by sending the cgi.rb library an HTTP request with multipart MIME encoding that contains a malformed MIME boundary specifier beginning with "-" instead of "--". Successful exploitation of the vulnerability causes the library to go into an infinite loop waiting for additional nonexistent input.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.5-r3"
Ruby WEBrick and XMLRPC servers are vulnerable to Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.4-r1 | >= 1.8.4-r1 |
Ruby is an interpreted scripting language for quick and easy object-oriented programming. It comes bundled with HTTP ("WEBrick") and XMLRPC server objects.
Ruby uses blocking sockets for WEBrick and XMLRPC servers.
An attacker could send large amounts of data to an affected server to block the socket and thus deny other connections to the server.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.4-r1"
Ruby is vulnerable to a security bypass of the safe level mechanism.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.3 | >= 1.8.3 |
Ruby is an interpreted scripting language for quick and easy object-oriented programming. Ruby supports the safe execution of untrusted code using a safe level and taint flag mechanism.
Dr. Yutaka Oiwa discovered that Ruby fails to properly enforce safe level protections.
An attacker could exploit this vulnerability to execute arbitrary code beyond the restrictions specified in each safe level.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.3"
A vulnerability in XMLRPC.iPIMethods allows remote attackers to execute arbitrary commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.2-r2 | >= 1.8.2-r2 |
Ruby is an interpreted scripting language for quick and easy object-oriented programming. XML-RPC is a remote procedure call protocol encoded in XML.
Nobuhiro IMAI reported that an invalid default value in "utils.rb" causes the security protections of the XML-RPC server to fail.
A remote attacker could exploit this vulnerability to execute arbitrary commands.
There is no known workaround at this time.
All Ruby users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.2-r2"
The CGI module in Ruby can be sent into an infinite loop, resulting in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.2_pre3 | >= 1.6.8-r12 (revision), >= 1.8.2_pre3 |
Ruby is an interpreted scripting language for quick and easy object-oriented programming. Ruby's CGI module can be used to build web applications.
Ruby's developers found and fixed an issue in the CGI module that can be triggered remotely and cause an infinite loop.
A remote attacker could trigger the vulnerability through an exposed Ruby web application and cause the server to use unnecessary CPU resources, potentially resulting in a Denial of Service.
There is no known workaround at this time.
All Ruby 1.6.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.6.8-r12"
All Ruby 1.8.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.2_pre3"
When used for CGI scripting, Ruby creates session files in /tmp with the permissions of the default umask. Depending on that umask, local users may be able to read sensitive data stored in session files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/ruby | * | < 1.8.2_pre2 | >= 1.6.8-r11 (revision), >= 1.8.0-r7 (revision), >= 1.8.2_pre2 |
Ruby is an Object Oriented, interpreted scripting language used for many system scripting tasks. It can also be used for CGI web applications.
The CGI::Session::FileStore implementation (and presumably CGI::Session::PStore), which allow data associated with a particular Session instance to be written to a file, writes to a file in /tmp with no regard for secure permissions. As a result, the file is left with whatever the default umask permissions are, which commonly would allow other local users to read the data from that session file.
Depending on the default umask, any data stored using these methods could be read by other users on the system.
By changing the default umask on the system to not permit read access to other users (e.g. 0700), one can prevent these files from being readable by other users.
All Ruby users should upgrade to the latest version:
# emerge sync # emerge -pv ">=dev-lang/ruby-your_version" # emerge ">=dev-lang/ruby-your_version"