ALAS-2012-035


Amazon Linux AMI Security Advisory: ALAS-2012-35
Advisory Release Date: 2014-09-14 15:12 Pacific
Severity: Important
References: CVE-2011-4815 

Issue Overview:

Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.


Affected Packages:

ruby


Issue Correction:
Run yum update ruby to update your system.

New Packages:
i686:
    ruby-1.8.7.357-1.10.amzn1.i686
    ruby-static-1.8.7.357-1.10.amzn1.i686
    ruby-libs-1.8.7.357-1.10.amzn1.i686
    ruby-ri-1.8.7.357-1.10.amzn1.i686
    ruby-debuginfo-1.8.7.357-1.10.amzn1.i686
    ruby-devel-1.8.7.357-1.10.amzn1.i686

noarch:
    ruby-irb-1.8.7.357-1.10.amzn1.noarch
    ruby-rdoc-1.8.7.357-1.10.amzn1.noarch

src:
    ruby-1.8.7.357-1.10.amzn1.src

x86_64:
    ruby-devel-1.8.7.357-1.10.amzn1.x86_64
    ruby-ri-1.8.7.357-1.10.amzn1.x86_64
    ruby-libs-1.8.7.357-1.10.amzn1.x86_64
    ruby-1.8.7.357-1.10.amzn1.x86_64
    ruby-static-1.8.7.357-1.10.amzn1.x86_64
    ruby-debuginfo-1.8.7.357-1.10.amzn1.x86_64