Anolis OS update for ruby:2.6 module

1) Type conversion

EUVDB-ID: #VU62081

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-28739

CWE-ID: CWE-704 - Type conversion

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a type conversion error in some convertion methods like Kernel#Float</code> and <code>String#to_f. A remote attacker can pass specially crafted data to the affected application, trigger memory corruption and execute arbitrary code in the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

rubygems-devel: before 3.0.3.1-109

rubygems: before 3.0.3.1-109

rubygem-xmlrpc: before 0.3.0-109

rubygem-test-unit: before 3.2.9-109

rubygem-rdoc: before 6.1.2.1-109

rubygem-rake: before 12.3.3-109

rubygem-power_assert: before 1.1.3-109

rubygem-pg-doc: before 1.1.4-1

rubygem-net-telnet: before 0.2.0-109

rubygem-mysql2-doc: before 0.5.2-1

rubygem-mongo-doc: before 2.8.0-1

rubygem-mongo: before 2.8.0-1

rubygem-minitest: before 5.11.3-109

rubygem-irb: before 1.0.0-109

rubygem-did_you_mean: before 1.3.0-109

rubygem-bundler: before 1.17.2-109

rubygem-bson-doc: before 4.5.0-1

rubygem-abrt-doc: before 0.3.0-4

rubygem-abrt: before 0.3.0-4

ruby-doc: before 2.6.10-109

rubygem-psych: before 3.1.0-109

rubygem-pg: before 1.1.4-1

rubygem-openssl: before 2.1.2-109

rubygem-mysql2: before 0.5.2-1

rubygem-json: before 2.1.0-109

rubygem-io-console: before 0.4.7-109

rubygem-bson: before 4.5.0-1

rubygem-bigdecimal: before 1.4.1-109

ruby-libs: before 2.6.10-109

ruby-devel: before 2.6.10-109

ruby: before 2.6.10-109

CPE2.3

• cpe:2.3:o:openanolis:anolis_os:8:*:*:*:*:*:*:*
• cpe:2.3:o:openanolis:rubygems-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygems:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-xmlrpc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-test-unit:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-rdoc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-rake:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-power_assert:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-pg-doc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-net-telnet:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-mysql2-doc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-mongo-doc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-mongo:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-minitest:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-irb:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-did_you_mean:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-bundler:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-bson-doc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-abrt-doc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-abrt:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:ruby-doc:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-psych:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-pg:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-openssl:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-mysql2:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-json:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-io-console:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-bson:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:rubygem-bigdecimal:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:ruby-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:ruby-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:o:openanolis:ruby:*:*:*:*:*:anolis_os:*:*

External links

https://anas.openanolis.cn/errata/detail/ANSA-2022:0565

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.