Input validation error in Package Manager Configurations - CVE-2021-24105

Vulnerability identifier: #VU50511

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-24105

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Package Managers Configurations. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Package Manager Configurations
Anolis OS
openEuler
rubygem-net-telnet
rubygem-abrt
rubygem-abrt-doc
rubygem-xmlrpc
rubygem-io-console
rubygem-mysql2-doc
rubygem-mysql2
rubygem-pg-doc
rubygem-pg
rubygem-irb
rubygem-power_assert
rubygem-did_you_mean
rubygem-bigdecimal
rubygem-bundler
rubygem-bundler-doc
rubygem-json
rubygem-openssl
rubygem-bundler-help
rubygem-mongo
rubygem-mongo-doc
ruby-libs
ruby-doc
ruby
ruby-devel
ruby-default-gems
rubygems-devel
rubygems
rubygem-psych
rubygem-test-unit
rubygem-bson-doc
rubygem-bson
rubygem-minitest
rubygem-rdoc
rubygem-rake

Install updates from vendor's website.

rubygem-net-telnet - addressed in versions 0.2.0-108, 0.2.0-137
rubygem-abrt - addressed in versions 0.3.0-4, 0.4.0-1
rubygem-abrt-doc - addressed in versions 0.3.0-4, 0.4.0-1
rubygem-xmlrpc - addressed in versions 0.3.0-108, 0.3.0-137
rubygem-io-console - addressed in versions 0.4.7-108, 0.5.6-137
rubygem-mysql2-doc - addressed in versions 0.4.10-4, 0.5.3-1
rubygem-mysql2 - addressed in versions 0.4.10-4, 0.5.3-1
rubygem-pg-doc - addressed in versions 1.0.0-2.0.1, 1.1.4-1, 1.2.3-1.0.1
rubygem-pg - addressed in versions 1.0.0-2.0.1, 1.1.4-1, 1.2.3-1.0.1
rubygem-irb - addressed in versions 1.0.0-108, 1.2.6-137
rubygem-power_assert - addressed in versions 1.1.3-108, 1.1.7-137
rubygem-did_you_mean - update to 1.3.0-108
rubygem-bigdecimal - addressed in versions 1.4.1-108, 2.0.0-137
rubygem-bundler - addressed in versions 1.16.1-4, 1.17.2-108, 2.2.24-137
rubygem-bundler-doc - update to 1.16.1-4
rubygem-json - addressed in versions 2.1.0-108, 2.3.0-137
rubygem-openssl - addressed in versions 2.1.2-108, 2.1.2-137
rubygem-bundler-help - update to 2.2.19-1
rubygem-bundler - update to 2.2.19-1
rubygem-mongo - addressed in versions 2.5.1-2, 2.8.0-1, 2.11.3-1
rubygem-mongo-doc - addressed in versions 2.5.1-2, 2.8.0-1, 2.11.3-1
ruby-libs - addressed in versions 2.6.9-108, 2.7.4-137
ruby-doc - addressed in versions 2.6.9-108, 2.7.4-137
ruby - addressed in versions 2.6.9-108, 2.7.4-137
ruby-devel - addressed in versions 2.6.9-108, 2.7.4-137
ruby-default-gems - update to 2.7.4-137
rubygems-devel - addressed in versions 3.0.3.1-108, 3.1.6-137
rubygems - addressed in versions 3.0.3.1-108, 3.1.6-137
rubygem-psych - addressed in versions 3.1.0-108, 3.1.0-137
rubygem-test-unit - addressed in versions 3.2.9-108, 3.3.4-137
rubygem-bson-doc - addressed in versions 4.3.0-2, 4.5.0-1, 4.8.1-1
rubygem-bson - addressed in versions 4.3.0-2, 4.5.0-1, 4.8.1-1
rubygem-minitest - addressed in versions 5.11.3-108, 5.13.0-137
rubygem-rdoc - addressed in versions 6.1.2.1-108, 6.2.1.1-137
rubygem-rake - addressed in versions 12.3.3-108, 13.0.1-137

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24105

• Remote code execution in Microsoft Package Managers Configurations
• openEuler 20.03 LTS SP1 update for rubygem-bundler
• Anolis OS update for ruby:2.7 module
• Anolis OS update for ruby:2.6 module
• Anolis OS update for ruby:2.5 module