ALAS-2018-1113


Amazon Linux AMI Security Advisory: ALAS-2018-1113
Advisory Release Date: 2018-12-14 19:27 Pacific
Severity: Important

Issue Overview:

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.(CVE-2018-16395 )

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.(CVE-2018-16396 )


Affected Packages:

ruby23,ruby24


Issue Correction:
Run yum update ruby23 to update your system.

New Packages:
i686:
    ruby23-devel-2.3.8-1.20.amzn1.i686
    ruby23-libs-2.3.8-1.20.amzn1.i686
    rubygem23-io-console-0.4.5-1.20.amzn1.i686
    ruby23-2.3.8-1.20.amzn1.i686
    rubygem23-json-1.8.3.1-1.20.amzn1.i686
    rubygem23-psych-2.1.0.1-1.20.amzn1.i686
    rubygem23-bigdecimal-1.2.8-1.20.amzn1.i686
    ruby23-debuginfo-2.3.8-1.20.amzn1.i686
    ruby24-libs-2.4.5-1.30.7.amzn1.i686
    rubygem24-json-2.0.4-1.30.7.amzn1.i686
    ruby24-2.4.5-1.30.7.amzn1.i686
    ruby24-devel-2.4.5-1.30.7.amzn1.i686
    rubygem24-xmlrpc-0.2.1-1.30.7.amzn1.i686
    rubygem24-bigdecimal-1.3.2-1.30.7.amzn1.i686
    ruby24-debuginfo-2.4.5-1.30.7.amzn1.i686
    rubygem24-psych-2.2.2-1.30.7.amzn1.i686
    rubygem24-io-console-0.4.6-1.30.7.amzn1.i686

noarch:
    ruby23-doc-2.3.8-1.20.amzn1.noarch
    rubygem23-did_you_mean-1.0.0-1.20.amzn1.noarch
    rubygems23-2.5.2.3-1.20.amzn1.noarch
    ruby23-irb-2.3.8-1.20.amzn1.noarch
    rubygems23-devel-2.5.2.3-1.20.amzn1.noarch
    rubygems24-devel-2.6.14.3-1.30.7.amzn1.noarch
    rubygem24-did_you_mean-1.1.0-1.30.7.amzn1.noarch
    rubygems24-2.6.14.3-1.30.7.amzn1.noarch
    ruby24-irb-2.4.5-1.30.7.amzn1.noarch
    ruby24-doc-2.4.5-1.30.7.amzn1.noarch

src:
    ruby23-2.3.8-1.20.amzn1.src
    ruby24-2.4.5-1.30.7.amzn1.src

x86_64:
    ruby23-devel-2.3.8-1.20.amzn1.x86_64
    ruby23-libs-2.3.8-1.20.amzn1.x86_64
    rubygem23-bigdecimal-1.2.8-1.20.amzn1.x86_64
    rubygem23-io-console-0.4.5-1.20.amzn1.x86_64
    rubygem23-psych-2.1.0.1-1.20.amzn1.x86_64
    rubygem23-json-1.8.3.1-1.20.amzn1.x86_64
    ruby23-debuginfo-2.3.8-1.20.amzn1.x86_64
    ruby23-2.3.8-1.20.amzn1.x86_64
    ruby24-libs-2.4.5-1.30.7.amzn1.x86_64
    rubygem24-xmlrpc-0.2.1-1.30.7.amzn1.x86_64
    ruby24-debuginfo-2.4.5-1.30.7.amzn1.x86_64
    ruby24-devel-2.4.5-1.30.7.amzn1.x86_64
    rubygem24-io-console-0.4.6-1.30.7.amzn1.x86_64
    rubygem24-bigdecimal-1.3.2-1.30.7.amzn1.x86_64
    rubygem24-psych-2.2.2-1.30.7.amzn1.x86_64
    rubygem24-json-2.0.4-1.30.7.amzn1.x86_64
    ruby24-2.4.5-1.30.7.amzn1.x86_64