ALASRUBY2.6-2023-002

Amazon Linux 2 Security Advisory: ALASRUBY2.6-2023-002
Advisory Release Date: 2023-08-07 05:23 Pacific
Advisory Updated Date: 2023-09-25 22:02 Pacific
Severity: Medium
Issue Overview:

A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service (ReDoS) during the parsing of dates. This flaw allows an attacker to hang a ruby application by providing a specially crafted date string. The highest threat to this vulnerability is system availability. (CVE-2021-41817)

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. (CVE-2021-41819)


Affected Packages:

ruby


Note:

This advisory is applicable to Amazon Linux 2 - Ruby2.6 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update ruby to update your system.

New Packages:
aarch64:
    ruby-2.6.9-129.amzn2.aarch64
    ruby-devel-2.6.9-129.amzn2.aarch64
    ruby-libs-2.6.9-129.amzn2.aarch64
    rubygem-bigdecimal-1.4.1-129.amzn2.aarch64
    rubygem-io-console-0.4.7-129.amzn2.aarch64
    rubygem-json-2.1.0-129.amzn2.aarch64
    rubygem-openssl-2.1.2-129.amzn2.aarch64
    rubygem-psych-3.1.0-129.amzn2.aarch64
    ruby-debuginfo-2.6.9-129.amzn2.aarch64

i686:
    ruby-2.6.9-129.amzn2.i686
    ruby-devel-2.6.9-129.amzn2.i686
    ruby-libs-2.6.9-129.amzn2.i686
    rubygem-bigdecimal-1.4.1-129.amzn2.i686
    rubygem-io-console-0.4.7-129.amzn2.i686
    rubygem-json-2.1.0-129.amzn2.i686
    rubygem-openssl-2.1.2-129.amzn2.i686
    rubygem-psych-3.1.0-129.amzn2.i686
    ruby-debuginfo-2.6.9-129.amzn2.i686

noarch:
    rubygems-3.0.3.1-129.amzn2.noarch
    rubygems-devel-3.0.3.1-129.amzn2.noarch
    rubygem-rake-12.3.3-129.amzn2.noarch
    rubygem-irb-1.0.0-129.amzn2.noarch
    rubygem-rdoc-6.1.2.1-129.amzn2.noarch
    ruby-doc-2.6.9-129.amzn2.noarch
    rubygem-did_you_mean-1.3.0-129.amzn2.noarch
    rubygem-minitest-5.11.3-129.amzn2.noarch
    rubygem-power_assert-1.1.3-129.amzn2.noarch
    rubygem-net-telnet-0.2.0-129.amzn2.noarch
    rubygem-test-unit-3.2.9-129.amzn2.noarch
    rubygem-xmlrpc-0.3.0-129.amzn2.noarch
    rubygem-bundler-1.17.2-129.amzn2.noarch

src:
    ruby-2.6.9-129.amzn2.src

x86_64:
    ruby-2.6.9-129.amzn2.x86_64
    ruby-devel-2.6.9-129.amzn2.x86_64
    ruby-libs-2.6.9-129.amzn2.x86_64
    rubygem-bigdecimal-1.4.1-129.amzn2.x86_64
    rubygem-io-console-0.4.7-129.amzn2.x86_64
    rubygem-json-2.1.0-129.amzn2.x86_64
    rubygem-openssl-2.1.2-129.amzn2.x86_64
    rubygem-psych-3.1.0-129.amzn2.x86_64
    ruby-debuginfo-2.6.9-129.amzn2.x86_64

Additional References

Red Hat: CVE-2021-41817, CVE-2021-41819

Mitre: CVE-2021-41817, CVE-2021-41819