Amazon Linux AMI update for ruby23

Published: 2018-12-07 10:04:44 | Updated: 2018-12-07
Severity Low
Patch available YES
Number of vulnerabilities 2
CVE ID CVE-2018-16396
CVE-2018-16395
CVSSv3 5.2 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]
6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]
CWE ID CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software Amazon Linux AMI
Vulnerable software versions Amazon Linux AMI 2017.03
Vendor URL Amazon Web Services, Inc.

Security Advisory

1) Security restrictions bypass

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to the tainted flags are not propagated with the BbH, and h directives. A remote attacker can supply inputs by Array#pack and/or String#unpack with these directives and checks the reliability with tainted flags and cause the check to be wrong to bypass security restrictions and conduct further attacks.

Remediation

Update the affected packages.

i686:
    ruby23-devel-2.3.8-1.20.amzn1.i686
    ruby23-libs-2.3.8-1.20.amzn1.i686
    rubygem23-io-console-0.4.5-1.20.amzn1.i686
    ruby23-2.3.8-1.20.amzn1.i686
    rubygem23-json-1.8.3.1-1.20.amzn1.i686
    rubygem23-psych-2.1.0.1-1.20.amzn1.i686
    rubygem23-bigdecimal-1.2.8-1.20.amzn1.i686
    ruby23-debuginfo-2.3.8-1.20.amzn1.i686

noarch:
    ruby23-doc-2.3.8-1.20.amzn1.noarch
    rubygem23-did_you_mean-1.0.0-1.20.amzn1.noarch
    rubygems23-2.5.2.3-1.20.amzn1.noarch
    ruby23-irb-2.3.8-1.20.amzn1.noarch
    rubygems23-devel-2.5.2.3-1.20.amzn1.noarch

src:
    ruby23-2.3.8-1.20.amzn1.src

x86_64:
    ruby23-devel-2.3.8-1.20.amzn1.x86_64
    ruby23-libs-2.3.8-1.20.amzn1.x86_64
    rubygem23-bigdecimal-1.2.8-1.20.amzn1.x86_64
    rubygem23-io-console-0.4.5-1.20.amzn1.x86_64
    rubygem23-psych-2.1.0.1-1.20.amzn1.x86_64
    rubygem23-json-1.8.3.1-1.20.amzn1.x86_64
    ruby23-debuginfo-2.3.8-1.20.amzn1.x86_64
    ruby23-2.3.8-1.20.amzn1.x86_64

External links

https://alas.aws.amazon.com/ALAS-2018-1113.html

2) Security restrictions bypass

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists in OpenSSL::X509::Name due to the equality check is not correct if the value of an entity of the argument (right-hand side) starts with the value of the receiver (left-hand side). A remote attacker can supply malicious X.509 certificate to be passed and bypass security restrictions to conduct further attacks.

Remediation

Update the affected packages.

i686:
    ruby23-devel-2.3.8-1.20.amzn1.i686
    ruby23-libs-2.3.8-1.20.amzn1.i686
    rubygem23-io-console-0.4.5-1.20.amzn1.i686
    ruby23-2.3.8-1.20.amzn1.i686
    rubygem23-json-1.8.3.1-1.20.amzn1.i686
    rubygem23-psych-2.1.0.1-1.20.amzn1.i686
    rubygem23-bigdecimal-1.2.8-1.20.amzn1.i686
    ruby23-debuginfo-2.3.8-1.20.amzn1.i686

noarch:
    ruby23-doc-2.3.8-1.20.amzn1.noarch
    rubygem23-did_you_mean-1.0.0-1.20.amzn1.noarch
    rubygems23-2.5.2.3-1.20.amzn1.noarch
    ruby23-irb-2.3.8-1.20.amzn1.noarch
    rubygems23-devel-2.5.2.3-1.20.amzn1.noarch

src:
    ruby23-2.3.8-1.20.amzn1.src

x86_64:
    ruby23-devel-2.3.8-1.20.amzn1.x86_64
    ruby23-libs-2.3.8-1.20.amzn1.x86_64
    rubygem23-bigdecimal-1.2.8-1.20.amzn1.x86_64
    rubygem23-io-console-0.4.5-1.20.amzn1.x86_64
    rubygem23-psych-2.1.0.1-1.20.amzn1.x86_64
    rubygem23-json-1.8.3.1-1.20.amzn1.x86_64
    ruby23-debuginfo-2.3.8-1.20.amzn1.x86_64
    ruby23-2.3.8-1.20.amzn1.x86_64

External links

https://alas.aws.amazon.com/ALAS-2018-1113.html

Back to List