SB2022101114 - Red Hat Software Collections update for rh-ruby27-ruby
Published: October 11, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2021-41816)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in CGI.escape_html. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Incorrect Regular Expression (CVE-ID: CVE-2021-41817)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions on date parsing methods. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
3) Spoofing attack (CVE-ID: CVE-2021-41819)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in CGI::Cookie.parse. A remote attacker can spoof page content.
4) Type conversion (CVE-ID: CVE-2022-28739)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a type conversion error in some convertion methods like Kernel#Float</code> and <code>String#to_f. A remote attacker can pass specially crafted data to the affected application, trigger memory corruption and execute arbitrary code in the system.
Remediation
Install update from vendor's website.