-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-ruby30-ruby security update Advisory ID: RHSA-2021:3982-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2021:3982 Issue date: 2021-10-25 CVE Names: CVE-2020-36327 CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 ===================================================================== 1. Summary: An update for rh-ruby30-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: rh-ruby30-ruby (3.0.2). Security Fix(es): * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327) * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799) * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810) * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1958999 - CVE-2020-36327 rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source 1980126 - CVE-2021-31810 ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host 1980128 - CVE-2021-32066 ruby: StartTLS stripping vulnerability in Net::IMAP 1980132 - CVE-2021-31799 rubygem-rdoc: Command injection vulnerability in RDoc 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-ruby30-ruby-3.0.2-148.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.2-148.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.2-148.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.22-148.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-148.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-148.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-148.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-148.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.0.4-148.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-148.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-148.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-148.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.12.0-148.el7.noarch.rpm rh-ruby30-rubygems-3.2.22-148.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.22-148.el7.noarch.rpm ppc64le: rh-ruby30-ruby-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.ppc64le.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.ppc64le.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.ppc64le.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.ppc64le.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.ppc64le.rpm s390x: rh-ruby30-ruby-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.s390x.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.s390x.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.s390x.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.s390x.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.s390x.rpm x86_64: rh-ruby30-ruby-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7): Source: rh-ruby30-ruby-3.0.2-148.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.2-148.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.2-148.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.22-148.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-148.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-148.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-148.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-148.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.0.4-148.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-148.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-148.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-148.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.12.0-148.el7.noarch.rpm rh-ruby30-rubygems-3.2.22-148.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.22-148.el7.noarch.rpm ppc64le: rh-ruby30-ruby-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.ppc64le.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.ppc64le.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.ppc64le.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.ppc64le.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.ppc64le.rpm s390x: rh-ruby30-ruby-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.s390x.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.s390x.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.s390x.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.s390x.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.s390x.rpm x86_64: rh-ruby30-ruby-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-ruby30-ruby-3.0.2-148.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.2-148.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.2-148.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.22-148.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-148.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-148.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-148.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-148.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.0.4-148.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-148.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-148.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-148.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.12.0-148.el7.noarch.rpm rh-ruby30-rubygems-3.2.22-148.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.22-148.el7.noarch.rpm x86_64: rh-ruby30-ruby-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-36327 https://access.redhat.com/security/cve/CVE-2021-31799 https://access.redhat.com/security/cve/CVE-2021-31810 https://access.redhat.com/security/cve/CVE-2021-32066 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYXcY89zjgjWX9erEAQgpFw/8CYxgU75ccdXpB75Wwh1wDSGvE65RwC/Z 4gPKdsXyOznJZhxgePOP7Vy0p/n3f1F6wlZEPDSsBnrKyhCsBoq5vKDBE+gtrkqC /k4W7RLW1IOb/ULi87RpABonZQQPWJr0jj+FC9o42qwAl4CAvDb1JiNaoGeQaOzy D+HYIVfR/Oqkeenet9rRsc/Fmjr0XvglcbRCRcLj7sXzbQo1xYWF0Z9FYBJIXqGW f8nl49x6NgguQt/O3jDhJkOWjAJfVANbP9K87noJzwkSEssc6KcUUlPJR0Wf40Xu YJVBuScEBUlQ6417eRzL7wmg9yNlDFTUw6JAwuLDdv6xKNMd5/UsbI5ALYn9LdLp eaPCPI3FC9kWyee8M9osri+Y0qNDjM5QlVBVMaw86jVwOdzoz7NxIlxo7lQQAZ/z CazS+gmpcFpu8xtu10KwCVSzNRucZ1h9sEB8fljzn+OHdTCCnbKB+V1L8uKFowdc OMvg/P73onKkRpZNFK/PIKWGZK7wgbpCxEvwbhldESpmqalJXjhJGC/BErXRBbIo 9S7h3ZjdoFlucK3QlZPdTDy6bC8lUxmQuy4q3Cqw7tCV6nc0hgdKLtglEx55ydSw VBv2iXp4jkLIDzDLl+XRF9NFYxWSqJ4DEUJIzB82yf7tULPKRvT0m7ABqmEj1/nR bVDldz4OTwk= =pQWj -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce