ruby2.7 - security update
ruby2.7 - security update
- Mettez à jour vers 2.7.4-1+deb11u5
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de ruby2.7
Vulnérabilités publiées pour ruby2.7 au cours des 30 derniers jours : 0. Présentes dans le catalogue KEV : 0.
Vulnérabilités : 13
ruby2.7 - regression update
ruby2.7 - regression update
- Mettez à jour vers 2.7.4-1+deb11u4
Publication Mise à jourruby2.7 - security update
ruby2.7 - security update
- Mettez à jour vers 2.7.4-1+deb11u3
Publication Mise à jourruby2.7 - security update
ruby2.7 - security update
- Mettez à jour vers 2.7.4-1+deb11u2
Publication Mise à jourCVE-2023-36617
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
- Mettez à jour vers 2.7.4-1+deb11u2
Publication Mise à jourCVE-2022-28739
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
- Mettez à jour vers 2.7.4-1+deb11u2
Publication Mise à jourCVE-2021-41816
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
- Mettez à jour vers 2.7.4-1+deb11u1
Publication Mise à jourruby2.7 - security update
ruby2.7 - security update
- Mettez à jour vers 2.7.4-1+deb11u1
Publication Mise à jourCVE-2021-41819
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
- Mettez à jour vers 2.7.4-1+deb11u1
Publication Mise à jourCVE-2021-41817
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
- Mettez à jour vers 2.7.4-1+deb11u1
Publication Mise à jourCVE-2021-31799
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
- Mettez à jour vers 2.7.4-1
Publication Mise à jourCVE-2021-28965
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
- Mettez à jour vers 2.7.3-1
Publication Mise à jourCVE-2020-10933
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
- Mettez à jour vers 2.7.1-1
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.