Описание
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.
Отчет
This issue affects the versions of rubygems as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. This issue affects the versions of rubygems as shipped with Red Hat Satellite version 6 on Red Hat Enterprise Linux version 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | rubygems | Will not fix | ||
| Red Hat Enterprise Linux 8 | ruby | Not affected | ||
| Red Hat Enterprise MRG 2 | rubygems | Will not fix | ||
| Red Hat Satellite 6 | rubygems | Will not fix | ||
| Red Hat Subscription Asset Manager | ruby193-rubygems | Will not fix | ||
| Red Hat Enterprise Linux 7 | ruby | Fixed | RHSA-2019:2028 | 06.08.2019 |
| Red Hat Enterprise Linux 7.4 Advanced Update Support | ruby | Fixed | RHSA-2020:0591 | 25.02.2020 |
| Red Hat Enterprise Linux 7.4 Telco Extended Update Support | ruby | Fixed | RHSA-2020:0591 | 25.02.2020 |
| Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions | ruby | Fixed | RHSA-2020:0591 | 25.02.2020 |
| Red Hat Enterprise Linux 7.5 Extended Update Support | ruby | Fixed | RHSA-2020:0542 | 19.02.2020 |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: ...
RubyGems Improper Input Validation vulnerability
Уязвимость системы управления пакетами RubyGems, связанная с некорректной обработкой параметров, позволяющая пользователю нарушить целостность данных
5.5 Medium
CVSS3