Red Hat Software Collections update for rh-ruby26-ruby

Published: 2021-06-07 | Updated: 2022-03-30

Risk	High
Patch available	YES
Number of vulnerabilities	9
CVE-ID	CVE-2019-3881 CVE-2019-15845 CVE-2019-16201 CVE-2019-16254 CVE-2019-16255 CVE-2020-10663 CVE-2020-10933 CVE-2020-25613 CVE-2021-28965
CWE-ID	CWE-552 CWE-20 CWE-113 CWE-94 CWE-200 CWE-444 CWE-611
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #8 is available.
Vulnerable software Subscribe	Red Hat Software Collections Universal components / Libraries / Software for developers rh-ruby26-ruby (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Files or Directories Accessible to External Parties

EUVDB-ID: #VU49352

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3881

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Bundler uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU23006

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15845

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists in Ruby due to insufficient validation of user-supplied files within File.fnmatch and File.fnmatch? functions when processing NUL byte in the filename. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU23007

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16201

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the WEBrick::HTTPAuth::DigestAuth in Ruby due to a regular expression issue. A remote attacker can send a specially crafted request to the application and perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) HTTP Response Splitting

EUVDB-ID: #VU23008

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16254

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP response splitting attack.

The vulnerability exists due to insufficient validation of CRLF sequences within the WEBrick in Ruby. A remote attacker can send a specially crafted request to the application and perform a spoofing attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Code injection

EUVDB-ID: #VU23009

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16255

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in lib/shell.rb in Ruby when processing Shell#[] and its alias Shell#test. A remote attacker can send a specially crafted request and execute arbitrary Ruby code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU32971

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10663

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information disclosure

EUVDB-ID: #VU31886

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10933

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to BasicSocket#read_nonblock method outputs previous value of the heap instead of copying the requested data. A remote attacker can gain access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU47333

Risk: Medium

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25613

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) XML External Entity injection

EUVDB-ID: #VU52000

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28965

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7

rh-ruby26-ruby (Red Hat package): before 2.6.7-119.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2021:2230

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.