ruby2.7 - security update
ruby2.7 - security update
- Update to 2.7.4-1+deb11u5
Published Updated
PatchFirst · Latest vulnerabilities
ruby2.7 vulnerabilities
Vulnerabilities published for ruby2.7 in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 13
ruby2.7 - regression update
ruby2.7 - regression update
- Update to 2.7.4-1+deb11u4
Published Updatedruby2.7 - security update
ruby2.7 - security update
- Update to 2.7.4-1+deb11u3
Published Updatedruby2.7 - security update
ruby2.7 - security update
- Update to 2.7.4-1+deb11u2
Published UpdatedCVE-2023-36617
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
- Update to 2.7.4-1+deb11u2
Published UpdatedCVE-2022-28739
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
- Update to 2.7.4-1+deb11u2
Published UpdatedCVE-2021-41816
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
- Update to 2.7.4-1+deb11u1
Published Updatedruby2.7 - security update
ruby2.7 - security update
- Update to 2.7.4-1+deb11u1
Published UpdatedCVE-2021-41819
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
- Update to 2.7.4-1+deb11u1
Published UpdatedCVE-2021-41817
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
- Update to 2.7.4-1+deb11u1
Published UpdatedCVE-2021-31799
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
- Update to 2.7.4-1
Published UpdatedCVE-2021-28965
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
- Update to 2.7.3-1
Published UpdatedCVE-2020-10933
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
- Update to 2.7.1-1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.