Amazon Linux 1 Security Advisory: ALAS-2012-35
Advisory Release Date: 2012-01-19 20:02 Pacific
Advisory Updated Date: 2014-09-14 15:12 Pacific
Severity:
Important
Issue Overview:
Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Affected Packages:
ruby
Issue Correction:
Run yum update ruby to update your system.
New Packages:
i686:
ruby-1.8.7.357-1.10.amzn1.i686
ruby-static-1.8.7.357-1.10.amzn1.i686
ruby-libs-1.8.7.357-1.10.amzn1.i686
ruby-ri-1.8.7.357-1.10.amzn1.i686
ruby-debuginfo-1.8.7.357-1.10.amzn1.i686
ruby-devel-1.8.7.357-1.10.amzn1.i686
noarch:
ruby-irb-1.8.7.357-1.10.amzn1.noarch
ruby-rdoc-1.8.7.357-1.10.amzn1.noarch
src:
ruby-1.8.7.357-1.10.amzn1.src
x86_64:
ruby-devel-1.8.7.357-1.10.amzn1.x86_64
ruby-ri-1.8.7.357-1.10.amzn1.x86_64
ruby-libs-1.8.7.357-1.10.amzn1.x86_64
ruby-1.8.7.357-1.10.amzn1.x86_64
ruby-static-1.8.7.357-1.10.amzn1.x86_64
ruby-debuginfo-1.8.7.357-1.10.amzn1.x86_64