Moderate: ruby:2.7 security, bug fix, and enhancement update

ELSA-2021-2584: ruby:2.7 security, bug fix, and enhancement update (MODERATE)

Moderate: ruby:2.5 security, bug fix, and enhancement update

ELSA-2021-2587: ruby:2.5 security, bug fix, and enhancement update (MODERATE)

Moderate: ruby:2.6 security, bug fix, and enhancement update

ELSA-2021-2588: ruby:2.6 security, bug fix, and enhancement update (MODERATE)

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, a ...

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, an ...

Security update for ruby2.5

Security update for ruby2.5

REXML round-trip instability

Уязвимость интерпретатора языка программирования Ruby, связанная с неверным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю оказать воздействие на целостность данных