ALAS2-2018-983

References: CVE-2017-17790  CVE-2018-1000073  CVE-2018-1000074  CVE-2018-1000075  CVE-2018-1000076  CVE-2018-1000077  CVE-2018-1000078  CVE-2018-1000079 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Path traversal when writing to a symlinked basedir outside of the root
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073)

Improper verification of signatures in tarball allows to install mis-signed gem:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076)

Infinite loop vulnerability due to negative size in tar header causes Denial of Service
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075)

Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution:
The "lazy_initialize" function in lib/resolv.rb did not properly process certain filenames. A remote attacker could possibly exploit this flaw to inject and execute arbitrary commands. (CVE-2017-17790)

Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000077)

XSS vulnerability in homepage attribute when displayed via gem server
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000078)

Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000074)

Path traversal issue during gem installation allows to write to arbitrary filesystem locations
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000079)

Issue Correction:
Run yum update ruby to update your system.

New Packages:

noarch:
    rubygems-2.0.14.1-33.amzn2.0.1.noarch
    rubygems-devel-2.0.14.1-33.amzn2.0.1.noarch
    rubygem-rake-0.9.6-33.amzn2.0.1.noarch
    ruby-irb-2.0.0.648-33.amzn2.0.1.noarch
    rubygem-rdoc-4.0.0-33.amzn2.0.1.noarch
    ruby-doc-2.0.0.648-33.amzn2.0.1.noarch
    rubygem-minitest-4.3.2-33.amzn2.0.1.noarch

src:
    ruby-2.0.0.648-33.amzn2.0.1.src

x86_64:
    ruby-2.0.0.648-33.amzn2.0.1.x86_64
    ruby-devel-2.0.0.648-33.amzn2.0.1.x86_64
    ruby-libs-2.0.0.648-33.amzn2.0.1.x86_64
    rubygem-bigdecimal-1.2.0-33.amzn2.0.1.x86_64
    rubygem-io-console-0.4.2-33.amzn2.0.1.x86_64
    rubygem-json-1.7.7-33.amzn2.0.1.x86_64
    rubygem-psych-2.0.0-33.amzn2.0.1.x86_64
    ruby-tcltk-2.0.0.648-33.amzn2.0.1.x86_64
    ruby-debuginfo-2.0.0.648-33.amzn2.0.1.x86_64