rpm package

suse/ruby2.5&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS

pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS

Vulnerabilities (9)

CVE	CVSS	Affected versions	Fixed in	Published	Description
CVE-2023-28756	—	< 2.5.9-150000.4.29.1	2.5.9-150000.4.29.1	Mar 31, 2023	A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
CVE-2023-28755	—	< 2.5.9-150000.4.29.1	2.5.9-150000.4.29.1	Mar 31, 2023	A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2
CVE-2021-33621	—	< 2.5.9-150000.4.29.1	2.5.9-150000.4.29.1	Nov 18, 2022	The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
CVE-2022-28739	—	< 2.5.9-150000.4.23.1	2.5.9-150000.4.23.1	May 9, 2022	There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
CVE-2021-41817	—	< 2.5.9-150000.4.23.1	2.5.9-150000.4.23.1	Jan 1, 2022	Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
CVE-2021-32066	—	< 2.5.9-150000.4.23.1	2.5.9-150000.4.23.1	Aug 1, 2021	An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network po
CVE-2021-31799	—	< 2.5.9-150000.4.23.1	2.5.9-150000.4.23.1	Jul 29, 2021	In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via \| and tags in a filename.
CVE-2021-31810	—	< 2.5.9-150000.4.23.1	2.5.9-150000.4.23.1	Jul 13, 2021	An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that a
CVE-2020-25613	—	< 2.5.8-4.14.1	2.5.8-4.14.1	Oct 6, 2020	An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (w

CVE-2023-28756Mar 31, 2023
affected < 2.5.9-150000.4.29.1fixed 2.5.9-150000.4.29.1
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
CVE-2023-28755Mar 31, 2023
affected < 2.5.9-150000.4.29.1fixed 2.5.9-150000.4.29.1
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2
CVE-2021-33621Nov 18, 2022
affected < 2.5.9-150000.4.29.1fixed 2.5.9-150000.4.29.1
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
CVE-2022-28739May 9, 2022
affected < 2.5.9-150000.4.23.1fixed 2.5.9-150000.4.23.1
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
CVE-2021-41817Jan 1, 2022
affected < 2.5.9-150000.4.23.1fixed 2.5.9-150000.4.23.1
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
CVE-2021-32066Aug 1, 2021
affected < 2.5.9-150000.4.23.1fixed 2.5.9-150000.4.23.1
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network po
CVE-2021-31799Jul 29, 2021
affected < 2.5.9-150000.4.23.1fixed 2.5.9-150000.4.23.1
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
CVE-2021-31810Jul 13, 2021
affected < 2.5.9-150000.4.23.1fixed 2.5.9-150000.4.23.1
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that a
CVE-2020-25613Oct 6, 2020
affected < 2.5.8-4.14.1fixed 2.5.8-4.14.1
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (w