OESA-2023-1226

Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1226
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2023-1226.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2023-1226
Upstream
Published
2023-04-14T11:05:09Z
Modified
2025-08-12T05:19:29.800650Z
Summary
ruby security update
Details

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.(CVE-2023-28756)

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.(CVE-2023-28755)

Database specific
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / ruby

Package

Name
ruby
Purl
pkg:rpm/openEuler/ruby&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.8-119.oe1

Ecosystem specific

{
    "aarch64": [
        "rubygem-json-2.1.0-119.oe1.aarch64.rpm",
        "rubygem-bigdecimal-1.3.4-119.oe1.aarch64.rpm",
        "ruby-debugsource-2.5.8-119.oe1.aarch64.rpm",
        "rubygem-io-console-0.4.6-119.oe1.aarch64.rpm",
        "ruby-debuginfo-2.5.8-119.oe1.aarch64.rpm",
        "rubygem-psych-3.0.2-119.oe1.aarch64.rpm",
        "rubygem-openssl-2.1.2-119.oe1.aarch64.rpm",
        "ruby-2.5.8-119.oe1.aarch64.rpm",
        "ruby-devel-2.5.8-119.oe1.aarch64.rpm"
    ],
    "x86_64": [
        "rubygem-psych-3.0.2-119.oe1.x86_64.rpm",
        "rubygem-io-console-0.4.6-119.oe1.x86_64.rpm",
        "ruby-devel-2.5.8-119.oe1.x86_64.rpm",
        "rubygem-json-2.1.0-119.oe1.x86_64.rpm",
        "ruby-debuginfo-2.5.8-119.oe1.x86_64.rpm",
        "rubygem-bigdecimal-1.3.4-119.oe1.x86_64.rpm",
        "ruby-debugsource-2.5.8-119.oe1.x86_64.rpm",
        "ruby-2.5.8-119.oe1.x86_64.rpm",
        "rubygem-openssl-2.1.2-119.oe1.x86_64.rpm"
    ],
    "src": [
        "ruby-2.5.8-119.oe1.src.rpm"
    ],
    "noarch": [
        "rubygem-rdoc-6.0.1.1-119.oe1.noarch.rpm",
        "rubygem-did_you_mean-1.2.0-119.oe1.noarch.rpm",
        "rubygem-test-unit-3.2.7-119.oe1.noarch.rpm",
        "ruby-help-2.5.8-119.oe1.noarch.rpm",
        "rubygem-xmlrpc-0.3.0-119.oe1.noarch.rpm",
        "rubygem-minitest-5.10.3-119.oe1.noarch.rpm",
        "rubygem-net-telnet-0.1.1-119.oe1.noarch.rpm",
        "rubygems-devel-2.7.6-119.oe1.noarch.rpm",
        "ruby-irb-2.5.8-119.oe1.noarch.rpm",
        "rubygem-power_assert-1.1.1-119.oe1.noarch.rpm",
        "rubygem-rake-12.3.0-119.oe1.noarch.rpm",
        "rubygems-2.7.6-119.oe1.noarch.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / ruby

Package

Name
ruby
Purl
pkg:rpm/openEuler/ruby&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.8-119.oe1

Ecosystem specific

{
    "aarch64": [
        "ruby-debugsource-2.5.8-119.oe1.aarch64.rpm",
        "rubygem-openssl-2.1.2-119.oe1.aarch64.rpm",
        "rubygem-json-2.1.0-119.oe1.aarch64.rpm",
        "ruby-debuginfo-2.5.8-119.oe1.aarch64.rpm",
        "rubygem-bigdecimal-1.3.4-119.oe1.aarch64.rpm",
        "rubygem-psych-3.0.2-119.oe1.aarch64.rpm",
        "ruby-2.5.8-119.oe1.aarch64.rpm",
        "ruby-devel-2.5.8-119.oe1.aarch64.rpm",
        "rubygem-io-console-0.4.6-119.oe1.aarch64.rpm"
    ],
    "x86_64": [
        "ruby-devel-2.5.8-119.oe1.x86_64.rpm",
        "rubygem-openssl-2.1.2-119.oe1.x86_64.rpm",
        "rubygem-bigdecimal-1.3.4-119.oe1.x86_64.rpm",
        "ruby-debuginfo-2.5.8-119.oe1.x86_64.rpm",
        "rubygem-json-2.1.0-119.oe1.x86_64.rpm",
        "ruby-2.5.8-119.oe1.x86_64.rpm",
        "rubygem-io-console-0.4.6-119.oe1.x86_64.rpm",
        "ruby-debugsource-2.5.8-119.oe1.x86_64.rpm",
        "rubygem-psych-3.0.2-119.oe1.x86_64.rpm"
    ],
    "src": [
        "ruby-2.5.8-119.oe1.src.rpm"
    ],
    "noarch": [
        "rubygem-minitest-5.10.3-119.oe1.noarch.rpm",
        "rubygem-net-telnet-0.1.1-119.oe1.noarch.rpm",
        "rubygems-2.7.6-119.oe1.noarch.rpm",
        "ruby-irb-2.5.8-119.oe1.noarch.rpm",
        "rubygem-rake-12.3.0-119.oe1.noarch.rpm",
        "rubygem-power_assert-1.1.1-119.oe1.noarch.rpm",
        "rubygems-devel-2.7.6-119.oe1.noarch.rpm",
        "rubygem-did_you_mean-1.2.0-119.oe1.noarch.rpm",
        "rubygem-test-unit-3.2.7-119.oe1.noarch.rpm",
        "rubygem-xmlrpc-0.3.0-119.oe1.noarch.rpm",
        "ruby-help-2.5.8-119.oe1.noarch.rpm",
        "rubygem-rdoc-6.0.1.1-119.oe1.noarch.rpm"
    ]
}

openEuler:22.03-LTS / ruby

Package

Name
ruby
Purl
pkg:rpm/openEuler/ruby&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.3-129.oe2203sp1

Ecosystem specific

{
    "aarch64": [
        "ruby-devel-3.0.3-129.oe2203.aarch64.rpm",
        "rubygem-openssl-2.2.1-129.oe2203.aarch64.rpm",
        "rubygem-bigdecimal-3.0.0-129.oe2203.aarch64.rpm",
        "ruby-debuginfo-3.0.3-129.oe2203.aarch64.rpm",
        "rubygem-io-console-0.5.7-129.oe2203.aarch64.rpm",
        "ruby-debugsource-3.0.3-129.oe2203.aarch64.rpm",
        "rubygem-json-2.5.1-129.oe2203.aarch64.rpm",
        "rubygem-psych-3.3.2-129.oe2203.aarch64.rpm",
        "ruby-3.0.3-129.oe2203.aarch64.rpm",
        "rubygem-json-2.5.1-129.oe2203sp1.aarch64.rpm",
        "rubygem-io-console-0.5.7-129.oe2203sp1.aarch64.rpm",
        "rubygem-openssl-2.2.1-129.oe2203sp1.aarch64.rpm",
        "ruby-debugsource-3.0.3-129.oe2203sp1.aarch64.rpm",
        "ruby-3.0.3-129.oe2203sp1.aarch64.rpm",
        "rubygem-psych-3.3.2-129.oe2203sp1.aarch64.rpm",
        "ruby-debuginfo-3.0.3-129.oe2203sp1.aarch64.rpm",
        "ruby-devel-3.0.3-129.oe2203sp1.aarch64.rpm",
        "rubygem-bigdecimal-3.0.0-129.oe2203sp1.aarch64.rpm"
    ],
    "x86_64": [
        "rubygem-psych-3.3.2-129.oe2203.x86_64.rpm",
        "rubygem-openssl-2.2.1-129.oe2203.x86_64.rpm",
        "rubygem-bigdecimal-3.0.0-129.oe2203.x86_64.rpm",
        "rubygem-io-console-0.5.7-129.oe2203.x86_64.rpm",
        "rubygem-json-2.5.1-129.oe2203.x86_64.rpm",
        "ruby-devel-3.0.3-129.oe2203.x86_64.rpm",
        "ruby-debuginfo-3.0.3-129.oe2203.x86_64.rpm",
        "ruby-debugsource-3.0.3-129.oe2203.x86_64.rpm",
        "ruby-3.0.3-129.oe2203.x86_64.rpm",
        "ruby-debugsource-3.0.3-129.oe2203sp1.x86_64.rpm",
        "ruby-3.0.3-129.oe2203sp1.x86_64.rpm",
        "rubygem-openssl-2.2.1-129.oe2203sp1.x86_64.rpm",
        "rubygem-json-2.5.1-129.oe2203sp1.x86_64.rpm",
        "ruby-devel-3.0.3-129.oe2203sp1.x86_64.rpm",
        "rubygem-io-console-0.5.7-129.oe2203sp1.x86_64.rpm",
        "rubygem-bigdecimal-3.0.0-129.oe2203sp1.x86_64.rpm",
        "rubygem-psych-3.3.2-129.oe2203sp1.x86_64.rpm",
        "ruby-debuginfo-3.0.3-129.oe2203sp1.x86_64.rpm"
    ],
    "src": [
        "ruby-3.0.3-129.oe2203.src.rpm",
        "ruby-3.0.3-129.oe2203sp1.src.rpm"
    ],
    "noarch": [
        "rubygem-rss-0.2.9-129.oe2203.noarch.rpm",
        "rubygem-rdoc-6.3.3-129.oe2203.noarch.rpm",
        "rubygem-typeprof-0.15.2-129.oe2203.noarch.rpm",
        "ruby-irb-3.0.3-129.oe2203.noarch.rpm",
        "ruby-help-3.0.3-129.oe2203.noarch.rpm",
        "rubygems-devel-3.2.32-129.oe2203.noarch.rpm",
        "rubygem-power_assert-1.2.0-129.oe2203.noarch.rpm",
        "rubygem-test-unit-3.3.7-129.oe2203.noarch.rpm",
        "rubygem-minitest-5.14.2-129.oe2203.noarch.rpm",
        "rubygem-rbs-1.4.0-129.oe2203.noarch.rpm",
        "rubygem-bundler-2.2.32-129.oe2203.noarch.rpm",
        "rubygem-did_you_mean-1.5.0-129.oe2203.noarch.rpm",
        "rubygem-rake-13.0.3-129.oe2203.noarch.rpm",
        "rubygems-3.2.32-129.oe2203.noarch.rpm",
        "rubygem-rexml-3.2.5-129.oe2203.noarch.rpm",
        "rubygem-rbs-1.4.0-129.oe2203sp1.noarch.rpm",
        "rubygems-3.2.32-129.oe2203sp1.noarch.rpm",
        "rubygem-power_assert-1.2.0-129.oe2203sp1.noarch.rpm",
        "rubygem-minitest-5.14.2-129.oe2203sp1.noarch.rpm",
        "rubygem-test-unit-3.3.7-129.oe2203sp1.noarch.rpm",
        "ruby-help-3.0.3-129.oe2203sp1.noarch.rpm",
        "ruby-irb-3.0.3-129.oe2203sp1.noarch.rpm",
        "rubygem-bundler-2.2.32-129.oe2203sp1.noarch.rpm",
        "rubygem-rexml-3.2.5-129.oe2203sp1.noarch.rpm",
        "rubygem-rake-13.0.3-129.oe2203sp1.noarch.rpm",
        "rubygem-rss-0.2.9-129.oe2203sp1.noarch.rpm",
        "rubygem-did_you_mean-1.5.0-129.oe2203sp1.noarch.rpm",
        "rubygems-devel-3.2.32-129.oe2203sp1.noarch.rpm",
        "rubygem-typeprof-0.15.2-129.oe2203sp1.noarch.rpm",
        "rubygem-rdoc-6.3.3-129.oe2203sp1.noarch.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / ruby

Package

Name
ruby
Purl
pkg:rpm/openEuler/ruby&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.3-129.oe2203sp1

Ecosystem specific

{
    "aarch64": [
        "rubygem-json-2.5.1-129.oe2203sp1.aarch64.rpm",
        "rubygem-io-console-0.5.7-129.oe2203sp1.aarch64.rpm",
        "rubygem-openssl-2.2.1-129.oe2203sp1.aarch64.rpm",
        "ruby-debugsource-3.0.3-129.oe2203sp1.aarch64.rpm",
        "ruby-3.0.3-129.oe2203sp1.aarch64.rpm",
        "rubygem-psych-3.3.2-129.oe2203sp1.aarch64.rpm",
        "ruby-debuginfo-3.0.3-129.oe2203sp1.aarch64.rpm",
        "ruby-devel-3.0.3-129.oe2203sp1.aarch64.rpm",
        "rubygem-bigdecimal-3.0.0-129.oe2203sp1.aarch64.rpm"
    ],
    "x86_64": [
        "ruby-debugsource-3.0.3-129.oe2203sp1.x86_64.rpm",
        "ruby-3.0.3-129.oe2203sp1.x86_64.rpm",
        "rubygem-openssl-2.2.1-129.oe2203sp1.x86_64.rpm",
        "rubygem-json-2.5.1-129.oe2203sp1.x86_64.rpm",
        "ruby-devel-3.0.3-129.oe2203sp1.x86_64.rpm",
        "rubygem-io-console-0.5.7-129.oe2203sp1.x86_64.rpm",
        "rubygem-bigdecimal-3.0.0-129.oe2203sp1.x86_64.rpm",
        "rubygem-psych-3.3.2-129.oe2203sp1.x86_64.rpm",
        "ruby-debuginfo-3.0.3-129.oe2203sp1.x86_64.rpm"
    ],
    "src": [
        "ruby-3.0.3-129.oe2203sp1.src.rpm"
    ],
    "noarch": [
        "rubygem-rbs-1.4.0-129.oe2203sp1.noarch.rpm",
        "rubygems-3.2.32-129.oe2203sp1.noarch.rpm",
        "rubygem-power_assert-1.2.0-129.oe2203sp1.noarch.rpm",
        "rubygem-minitest-5.14.2-129.oe2203sp1.noarch.rpm",
        "rubygem-test-unit-3.3.7-129.oe2203sp1.noarch.rpm",
        "ruby-help-3.0.3-129.oe2203sp1.noarch.rpm",
        "ruby-irb-3.0.3-129.oe2203sp1.noarch.rpm",
        "rubygem-bundler-2.2.32-129.oe2203sp1.noarch.rpm",
        "rubygem-rexml-3.2.5-129.oe2203sp1.noarch.rpm",
        "rubygem-rake-13.0.3-129.oe2203sp1.noarch.rpm",
        "rubygem-rss-0.2.9-129.oe2203sp1.noarch.rpm",
        "rubygem-did_you_mean-1.5.0-129.oe2203sp1.noarch.rpm",
        "rubygems-devel-3.2.32-129.oe2203sp1.noarch.rpm",
        "rubygem-typeprof-0.15.2-129.oe2203sp1.noarch.rpm",
        "rubygem-rdoc-6.3.3-129.oe2203sp1.noarch.rpm"
    ]
}