ALASRUBY3.0-2023-001

Amazon Linux 2 Security Advisory: ALASRUBY3.0-2023-001
Advisory Release Date: 2023-08-04 20:34 Pacific
Advisory Updated Date: 2023-09-25 22:01 Pacific
Severity: Important
Issue Overview:

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)


Affected Packages:

ruby


Note:

This advisory is applicable to Amazon Linux 2 - Ruby3.0 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update ruby to update your system.

New Packages:
aarch64:
    ruby-3.0.6-156.amzn2.0.1.aarch64
    ruby-devel-3.0.6-156.amzn2.0.1.aarch64
    ruby-libs-3.0.6-156.amzn2.0.1.aarch64
    rubygem-bigdecimal-3.0.0-156.amzn2.0.1.aarch64
    rubygem-io-console-0.5.7-156.amzn2.0.1.aarch64
    rubygem-json-2.5.1-156.amzn2.0.1.aarch64
    rubygem-psych-3.3.2-156.amzn2.0.1.aarch64
    ruby-debuginfo-3.0.6-156.amzn2.0.1.aarch64

noarch:
    rubygems-3.2.33-156.amzn2.0.1.noarch
    rubygems-devel-3.2.33-156.amzn2.0.1.noarch
    ruby-default-gems-3.0.6-156.amzn2.0.1.noarch
    rubygem-irb-1.3.5-156.amzn2.0.1.noarch
    rubygem-rdoc-6.3.3-156.amzn2.0.1.noarch
    ruby-doc-3.0.6-156.amzn2.0.1.noarch
    rubygem-bundler-2.2.33-156.amzn2.0.1.noarch
    rubygem-minitest-5.14.2-156.amzn2.0.1.noarch
    rubygem-power_assert-1.2.0-156.amzn2.0.1.noarch
    rubygem-rake-13.0.3-156.amzn2.0.1.noarch
    rubygem-rbs-1.4.0-156.amzn2.0.1.noarch
    rubygem-test-unit-3.3.7-156.amzn2.0.1.noarch
    rubygem-rexml-3.2.5-156.amzn2.0.1.noarch
    rubygem-rss-0.2.9-156.amzn2.0.1.noarch
    rubygem-typeprof-0.15.2-156.amzn2.0.1.noarch

src:
    ruby-3.0.6-156.amzn2.0.1.src

x86_64:
    ruby-3.0.6-156.amzn2.0.1.x86_64
    ruby-devel-3.0.6-156.amzn2.0.1.x86_64
    ruby-libs-3.0.6-156.amzn2.0.1.x86_64
    rubygem-bigdecimal-3.0.0-156.amzn2.0.1.x86_64
    rubygem-io-console-0.5.7-156.amzn2.0.1.x86_64
    rubygem-json-2.5.1-156.amzn2.0.1.x86_64
    rubygem-psych-3.3.2-156.amzn2.0.1.x86_64
    ruby-debuginfo-3.0.6-156.amzn2.0.1.x86_64

Additional References

Red Hat: CVE-2023-28755, CVE-2023-28756

Mitre: CVE-2023-28755, CVE-2023-28756