rpm package
almalinux/rubygem-bson-doc
pkg:rpm/almalinux/rubygem-bson-doc
Vulnerabilities (30)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-42258 | Med | 5.3 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | May 9, 2026 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issu | |
| CVE-2026-42246 | Hig | 7.4 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | May 9, 2026 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in | |
| CVE-2024-49761 | Hig | 7.5 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | Oct 28, 2024 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected mainta | |
| CVE-2024-35176 | Med | 5.3 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | May 16, 2024 | REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include t | |
| CVE-2024-27282 | Med | 6.6 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | May 14, 2024 | An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2 | |
| CVE-2024-27281 | Med | 4.5 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | May 14, 2024 | An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the cl | |
| CVE-2024-27280 | Cri | 9.8 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | May 14, 2024 | A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0. | |
| CVE-2023-36617 | Med | 5.3 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | Jun 29, 2023 | A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue | |
| CVE-2023-28756 | Med | 5.3 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | Mar 31, 2023 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. | |
| CVE-2023-28755 | Med | 5.3 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | Mar 31, 2023 | A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 | |
| CVE-2021-33621 | Hig | 8.8 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | Nov 18, 2022 | The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object. | |
| CVE-2022-28739 | Hig | 7.5 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | May 9, 2022 | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. | |
| CVE-2021-41819 | Hig | 7.5 | < 4.5.0-1.module_el8.5.0+250+ba22dbf7 | 4.5.0-1.module_el8.5.0+250+ba22dbf7 | Jan 1, 2022 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. | |
| CVE-2021-41817 | Hig | 7.5 | < 4.5.0-1.module_el8.5.0+250+ba22dbf7 | 4.5.0-1.module_el8.5.0+250+ba22dbf7 | Jan 1, 2022 | Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. | |
| CVE-2021-43809 | Med | 6.7 | < 4.3.0-2.module_el8.5.0+2625+ec418553 | 4.3.0-2.module_el8.5.0+2625+ec418553 | Dec 8, 2021 | `Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code ins | |
| CVE-2021-32066 | Hig | 7.4 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | Aug 1, 2021 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network po | |
| CVE-2021-31799 | Hig | 7.0 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | Jul 30, 2021 | In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename. | |
| CVE-2021-31810 | Med | 5.8 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | Jul 13, 2021 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that a | |
| CVE-2020-36327 | Hig | 8.8 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | Apr 29, 2021 | Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another | |
| CVE-2021-28965 | Hig | 7.5 | < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | 4.8.1-1.module_el8.3.0+6147+d0dfc1e4 | Apr 21, 2021 | The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. |
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issu
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected mainta
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include t
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the cl
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
- affected < 4.5.0-1.module_el8.5.0+250+ba22dbf7fixed 4.5.0-1.module_el8.5.0+250+ba22dbf7
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
- affected < 4.5.0-1.module_el8.5.0+250+ba22dbf7fixed 4.5.0-1.module_el8.5.0+250+ba22dbf7
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
- affected < 4.3.0-2.module_el8.5.0+2625+ec418553fixed 4.3.0-2.module_el8.5.0+2625+ec418553
`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code ins
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network po
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that a
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another
- affected < 4.8.1-1.module_el8.3.0+6147+d0dfc1e4fixed 4.8.1-1.module_el8.3.0+6147+d0dfc1e4
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Page 1 of 2