{"id":"MGASA-2021-0579","summary":"Updated ruby packages fix security vulnerability","details":"Bundler sometimes chooses a dependency source based on the highest gem\nversion number, which means that a rogue gem found at a public source\nmay be chosen, even if the intended choice was a private gem that is a\ndependency of another private gem that is explicitly depended on by the\napplication. (CVE-2020-36327)\n\nThe REXML gem does not properly address XML round-trip issues. An\nincorrect document can be produced after parsing and serializing.\n(CVE-2021-28965)\n\nIn RDoc it is possible to execute arbitrary code via | and tags in a\nfilename. (CVE-2021-31799)\n\nA malicious FTP server can use the PASV response to trick Net::FTP into\nconnecting back to a given IP address and port. This potentially makes\ncurl extract information about services that are otherwise private and not\ndisclosed (e.g., the attacker can conduct port scans and service banner\nextractions).  (CVE-2021-31810)\n\nRuby Net::IMAP does not raise an exception when StartTLS fails with an an\nunknown response, which might allow man-in-the-middle attackers to bypass\nthe TLS protections by leveraging a network position between the client\nand the registry to block the StartTLS command, aka a \"StartTLS stripping\nattack.\" (CVE-2021-32066)\n\nBuffer Overrun in CGI.escape_html (CVE-2021-41816)\n\nRegular Expression Denial of Service Vulnerability of Date Parsing Methods\n(CVE-2021-41817)\n\nCookie Prefix Spoofing in CGI::Cookie.parse (CVE-2021-41819)\n","modified":"2026-02-04T03:17:29.939419Z","published":"2021-12-23T21:01:45Z","related":["CVE-2020-36327","CVE-2021-28965","CVE-2021-31799","CVE-2021-31810","CVE-2021-32066","CVE-2021-41816","CVE-2021-41817","CVE-2021-41819"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2021-0579.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=29004"},{"type":"REPORT","url":"https://ubuntu.com/security/notices/USN-4922-1"},{"type":"REPORT","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VF3QUOV6OJPCL64ZDHTQRENRJQZPZO6S/"},{"type":"REPORT","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CMW3G6JZK6A7ZRJZ7VOMELHWOQBYPIOY/"},{"type":"REPORT","url":"https://ubuntu.com/security/notices/USN-5020-1"},{"type":"REPORT","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/"},{"type":"REPORT","url":"http://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/"},{"type":"REPORT","url":"http://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/"},{"type":"REPORT","url":"http://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/"}],"affected":[{"package":{"name":"ruby","ecosystem":"Mageia:8","purl":"pkg:rpm/mageia/ruby?arch=source&distro=mageia-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-33.2.mga8"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2021-0579.json"}}],"schema_version":"1.7.3","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}