Anolis OS update for ruby:2.7 module

Published: 2022-09-26 | Updated: 2025-03-28

Risk	High
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2021-41817 CVE-2021-41819 CVE-2022-28739
CWE-ID	CWE-185 CWE-451 CWE-704
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Anolis OS Operating systems & Components / Operating system rubygems-devel Operating systems & Components / Operating system package or component rubygems Operating systems & Components / Operating system package or component rubygem-xmlrpc Operating systems & Components / Operating system package or component rubygem-test-unit Operating systems & Components / Operating system package or component rubygem-rdoc Operating systems & Components / Operating system package or component rubygem-rake Operating systems & Components / Operating system package or component rubygem-power_assert Operating systems & Components / Operating system package or component rubygem-net-telnet Operating systems & Components / Operating system package or component rubygem-minitest Operating systems & Components / Operating system package or component rubygem-irb Operating systems & Components / Operating system package or component rubygem-bundler Operating systems & Components / Operating system package or component ruby-doc Operating systems & Components / Operating system package or component ruby-default-gems Operating systems & Components / Operating system package or component rubygem-psych Operating systems & Components / Operating system package or component rubygem-openssl Operating systems & Components / Operating system package or component rubygem-json Operating systems & Components / Operating system package or component rubygem-io-console Operating systems & Components / Operating system package or component rubygem-bigdecimal Operating systems & Components / Operating system package or component ruby-libs Operating systems & Components / Operating system package or component ruby-devel Operating systems & Components / Operating system package or component ruby Operating systems & Components / Operating system package or component rubygem-pg-doc Operating systems & Components / Operating system package or component rubygem-mysql2-doc Operating systems & Components / Operating system package or component rubygem-mongo-doc Operating systems & Components / Operating system package or component rubygem-mongo Operating systems & Components / Operating system package or component rubygem-bson-doc Operating systems & Components / Operating system package or component rubygem-abrt-doc Operating systems & Components / Operating system package or component rubygem-abrt Operating systems & Components / Operating system package or component rubygem-pg Operating systems & Components / Operating system package or component rubygem-mysql2 Operating systems & Components / Operating system package or component rubygem-bson Operating systems & Components / Operating system package or component
Vendor	OpenAnolis

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Incorrect Regular Expression

EUVDB-ID: #VU59824

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-41817

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions on date parsing methods. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

rubygems-devel: before 3.1.6-138.0.1

rubygems: before 3.1.6-138.0.1

rubygem-xmlrpc: before 0.3.0-138.0.1

rubygem-test-unit: before 3.3.4-138.0.1

rubygem-rdoc: before 6.2.1.1-138.0.1

rubygem-rake: before 13.0.1-138.0.1

rubygem-power_assert: before 1.1.7-138.0.1

rubygem-net-telnet: before 0.2.0-138.0.1

rubygem-minitest: before 5.13.0-138.0.1

rubygem-irb: before 1.2.6-138.0.1

rubygem-bundler: before 2.2.24-138.0.1

ruby-doc: before 2.7.6-138.0.1

ruby-default-gems: before 2.7.6-138.0.1

rubygem-psych: before 3.1.0-138.0.1

rubygem-openssl: before 2.1.3-138.0.1

rubygem-json: before 2.3.0-138.0.1

rubygem-io-console: before 0.5.6-138.0.1

rubygem-bigdecimal: before 2.0.0-138.0.1

ruby-libs: before 2.7.6-138.0.1

ruby-devel: before 2.7.6-138.0.1

ruby: before 2.7.6-138.0.1

rubygem-pg-doc: before 1.2.3-1.0.1

rubygem-mysql2-doc: before 0.5.3-1

rubygem-mongo-doc: before 2.11.3-1

rubygem-mongo: before 2.11.3-1

rubygem-bson-doc: before 4.8.1-1

rubygem-abrt-doc: before 0.4.0-1

rubygem-abrt: before 0.4.0-1

rubygem-pg: before 1.2.3-1.0.1

rubygem-mysql2: before 0.5.3-1

rubygem-bson: before 4.8.1-1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2022:0719

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Spoofing attack

EUVDB-ID: #VU58365

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-41819

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in CGI::Cookie.parse. A remote attacker can spoof page content.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

rubygems-devel: before 3.1.6-138.0.1

rubygems: before 3.1.6-138.0.1

rubygem-xmlrpc: before 0.3.0-138.0.1

rubygem-test-unit: before 3.3.4-138.0.1

rubygem-rdoc: before 6.2.1.1-138.0.1

rubygem-rake: before 13.0.1-138.0.1

rubygem-power_assert: before 1.1.7-138.0.1

rubygem-net-telnet: before 0.2.0-138.0.1

rubygem-minitest: before 5.13.0-138.0.1

rubygem-irb: before 1.2.6-138.0.1

rubygem-bundler: before 2.2.24-138.0.1

ruby-doc: before 2.7.6-138.0.1

ruby-default-gems: before 2.7.6-138.0.1

rubygem-psych: before 3.1.0-138.0.1

rubygem-openssl: before 2.1.3-138.0.1

rubygem-json: before 2.3.0-138.0.1

rubygem-io-console: before 0.5.6-138.0.1

rubygem-bigdecimal: before 2.0.0-138.0.1

ruby-libs: before 2.7.6-138.0.1

ruby-devel: before 2.7.6-138.0.1

ruby: before 2.7.6-138.0.1

rubygem-pg-doc: before 1.2.3-1.0.1

rubygem-mysql2-doc: before 0.5.3-1

rubygem-mongo-doc: before 2.11.3-1

rubygem-mongo: before 2.11.3-1

rubygem-bson-doc: before 4.8.1-1

rubygem-abrt-doc: before 0.4.0-1

rubygem-abrt: before 0.4.0-1

rubygem-pg: before 1.2.3-1.0.1

rubygem-mysql2: before 0.5.3-1

rubygem-bson: before 4.8.1-1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2022:0719

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Type conversion

EUVDB-ID: #VU62081

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-28739

CWE-ID: CWE-704 - Type conversion

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a type conversion error in some convertion methods like Kernel#Float</code> and <code>String#to_f. A remote attacker can pass specially crafted data to the affected application, trigger memory corruption and execute arbitrary code in the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 8

rubygems-devel: before 3.1.6-138.0.1

rubygems: before 3.1.6-138.0.1

rubygem-xmlrpc: before 0.3.0-138.0.1

rubygem-test-unit: before 3.3.4-138.0.1

rubygem-rdoc: before 6.2.1.1-138.0.1

rubygem-rake: before 13.0.1-138.0.1

rubygem-power_assert: before 1.1.7-138.0.1

rubygem-net-telnet: before 0.2.0-138.0.1

rubygem-minitest: before 5.13.0-138.0.1

rubygem-irb: before 1.2.6-138.0.1

rubygem-bundler: before 2.2.24-138.0.1

ruby-doc: before 2.7.6-138.0.1

ruby-default-gems: before 2.7.6-138.0.1

rubygem-psych: before 3.1.0-138.0.1

rubygem-openssl: before 2.1.3-138.0.1

rubygem-json: before 2.3.0-138.0.1

rubygem-io-console: before 0.5.6-138.0.1

rubygem-bigdecimal: before 2.0.0-138.0.1

ruby-libs: before 2.7.6-138.0.1

ruby-devel: before 2.7.6-138.0.1

ruby: before 2.7.6-138.0.1

rubygem-pg-doc: before 1.2.3-1.0.1

rubygem-mysql2-doc: before 0.5.3-1

rubygem-mongo-doc: before 2.11.3-1

rubygem-mongo: before 2.11.3-1

rubygem-bson-doc: before 4.8.1-1

rubygem-abrt-doc: before 0.4.0-1

rubygem-abrt: before 0.4.0-1

rubygem-pg: before 1.2.3-1.0.1

rubygem-mysql2: before 0.5.3-1

rubygem-bson: before 4.8.1-1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2022:0719

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.