OESA-2021-1306

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1306

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2021-1306.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2021-1306

Upstream

CVE-2021-31799

CVE-2021-31810

CVE-2021-32066

Published

2021-08-06T11:03:07Z

Modified

2025-08-12T05:08:11.520338Z

Summary

ruby security update

Details

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.(CVE-2021-31799)

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).(CVE-2021-31810)

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."(CVE-2021-32066)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:20.03-LTS-SP1 / ruby

Package

Name: ruby
Purl: pkg:rpm/openEuler/ruby&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5.8-114.oe1

Ecosystem specific

{
    "x86_64": [
        "rubygem-json-2.1.0-114.oe1.x86_64.rpm",
        "ruby-devel-2.5.8-114.oe1.x86_64.rpm",
        "rubygem-bigdecimal-1.3.4-114.oe1.x86_64.rpm",
        "rubygem-io-console-0.4.6-114.oe1.x86_64.rpm",
        "rubygem-psych-3.0.2-114.oe1.x86_64.rpm",
        "ruby-2.5.8-114.oe1.x86_64.rpm",
        "ruby-debuginfo-2.5.8-114.oe1.x86_64.rpm",
        "rubygem-openssl-2.1.2-114.oe1.x86_64.rpm",
        "ruby-debugsource-2.5.8-114.oe1.x86_64.rpm"
    ],
    "src": [
        "ruby-2.5.8-114.oe1.src.rpm"
    ],
    "noarch": [
        "rubygem-xmlrpc-0.3.0-114.oe1.noarch.rpm",
        "rubygem-test-unit-3.2.7-114.oe1.noarch.rpm",
        "ruby-irb-2.5.8-114.oe1.noarch.rpm",
        "rubygem-net-telnet-0.1.1-114.oe1.noarch.rpm",
        "rubygem-rake-12.3.0-114.oe1.noarch.rpm",
        "ruby-help-2.5.8-114.oe1.noarch.rpm",
        "rubygems-2.7.6-114.oe1.noarch.rpm",
        "rubygem-did_you_mean-1.2.0-114.oe1.noarch.rpm",
        "rubygem-rdoc-6.0.1.1-114.oe1.noarch.rpm",
        "rubygem-power_assert-1.1.1-114.oe1.noarch.rpm",
        "rubygem-minitest-5.10.3-114.oe1.noarch.rpm",
        "rubygems-devel-2.7.6-114.oe1.noarch.rpm"
    ],
    "aarch64": [
        "ruby-2.5.8-114.oe1.aarch64.rpm",
        "rubygem-io-console-0.4.6-114.oe1.aarch64.rpm",
        "rubygem-bigdecimal-1.3.4-114.oe1.aarch64.rpm",
        "ruby-devel-2.5.8-114.oe1.aarch64.rpm",
        "ruby-debugsource-2.5.8-114.oe1.aarch64.rpm",
        "rubygem-json-2.1.0-114.oe1.aarch64.rpm",
        "ruby-debuginfo-2.5.8-114.oe1.aarch64.rpm",
        "rubygem-psych-3.0.2-114.oe1.aarch64.rpm",
        "rubygem-openssl-2.1.2-114.oe1.aarch64.rpm"
    ]
}

openEuler:20.03-LTS-SP2 / ruby

Package

Name: ruby
Purl: pkg:rpm/openEuler/ruby&distro=openEuler-20.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5.8-114.oe1

Ecosystem specific

{
    "x86_64": [
        "rubygem-json-2.1.0-114.oe1.x86_64.rpm",
        "ruby-2.5.8-114.oe1.x86_64.rpm",
        "rubygem-bigdecimal-1.3.4-114.oe1.x86_64.rpm",
        "rubygem-openssl-2.1.2-114.oe1.x86_64.rpm",
        "rubygem-psych-3.0.2-114.oe1.x86_64.rpm",
        "ruby-devel-2.5.8-114.oe1.x86_64.rpm",
        "ruby-debugsource-2.5.8-114.oe1.x86_64.rpm",
        "ruby-debuginfo-2.5.8-114.oe1.x86_64.rpm",
        "rubygem-io-console-0.4.6-114.oe1.x86_64.rpm"
    ],
    "src": [
        "ruby-2.5.8-114.oe1.src.rpm"
    ],
    "noarch": [
        "rubygem-rake-12.3.0-114.oe1.noarch.rpm",
        "ruby-help-2.5.8-114.oe1.noarch.rpm",
        "rubygem-power_assert-1.1.1-114.oe1.noarch.rpm",
        "ruby-irb-2.5.8-114.oe1.noarch.rpm",
        "rubygem-did_you_mean-1.2.0-114.oe1.noarch.rpm",
        "rubygem-minitest-5.10.3-114.oe1.noarch.rpm",
        "rubygem-xmlrpc-0.3.0-114.oe1.noarch.rpm",
        "rubygem-rdoc-6.0.1.1-114.oe1.noarch.rpm",
        "rubygem-net-telnet-0.1.1-114.oe1.noarch.rpm",
        "rubygem-test-unit-3.2.7-114.oe1.noarch.rpm",
        "rubygems-2.7.6-114.oe1.noarch.rpm",
        "rubygems-devel-2.7.6-114.oe1.noarch.rpm"
    ],
    "aarch64": [
        "rubygem-psych-3.0.2-114.oe1.aarch64.rpm",
        "rubygem-io-console-0.4.6-114.oe1.aarch64.rpm",
        "ruby-devel-2.5.8-114.oe1.aarch64.rpm",
        "ruby-2.5.8-114.oe1.aarch64.rpm",
        "rubygem-json-2.1.0-114.oe1.aarch64.rpm",
        "rubygem-bigdecimal-1.3.4-114.oe1.aarch64.rpm",
        "rubygem-openssl-2.1.2-114.oe1.aarch64.rpm",
        "ruby-debugsource-2.5.8-114.oe1.aarch64.rpm",
        "ruby-debuginfo-2.5.8-114.oe1.aarch64.rpm"
    ]
}