ruby2.7 - security update
ruby2.7 - security update
- Обновитесь до 2.7.4-1+deb11u5
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости ruby2.7
За последние 30 дней в ruby2.7 опубликовано уязвимостей: 0; в каталоге KEV: 0.
Уязвимостей: 13
ruby2.7 - regression update
ruby2.7 - regression update
- Обновитесь до 2.7.4-1+deb11u4
Опубликовано Обновленоruby2.7 - security update
ruby2.7 - security update
- Обновитесь до 2.7.4-1+deb11u3
Опубликовано Обновленоruby2.7 - security update
ruby2.7 - security update
- Обновитесь до 2.7.4-1+deb11u2
Опубликовано ОбновленоCVE-2023-36617
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
- Обновитесь до 2.7.4-1+deb11u2
Опубликовано ОбновленоCVE-2022-28739
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
- Обновитесь до 2.7.4-1+deb11u2
Опубликовано ОбновленоCVE-2021-41816
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
- Обновитесь до 2.7.4-1+deb11u1
Опубликовано Обновленоruby2.7 - security update
ruby2.7 - security update
- Обновитесь до 2.7.4-1+deb11u1
Опубликовано ОбновленоCVE-2021-41819
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
- Обновитесь до 2.7.4-1+deb11u1
Опубликовано ОбновленоCVE-2021-41817
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
- Обновитесь до 2.7.4-1+deb11u1
Опубликовано ОбновленоCVE-2021-31799
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
- Обновитесь до 2.7.4-1
Опубликовано ОбновленоCVE-2021-28965
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
- Обновитесь до 2.7.3-1
Опубликовано ОбновленоCVE-2020-10933
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
- Обновитесь до 2.7.1-1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.