Moderate: ruby:2.5 security update

ELSA-2023-7025: ruby:2.5 security update (MODERATE)

Moderate: ruby:2.7 security, bug fix, and enhancement update

ELSA-2023-3821: ruby:2.7 security, bug fix, and enhancement update (MODERATE)

Security update for ruby2.5

Moderate: ruby:3.1 security, bug fix, and enhancement update

Moderate: ruby:3.1 security, bug fix, and enhancement update

ELSA-2024-1576: ruby:3.1 security, bug fix, and enhancement update (MODERATE)

ELSA-2024-1431: ruby:3.1 security, bug fix, and enhancement update (MODERATE)

Moderate: ruby:3.0 security update

ELSA-2024-3838: ruby security update (MODERATE)

ELSA-2024-3500: ruby:3.0 security update (MODERATE)

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 ...

HTTP response splitting in CGI

Уязвимость компонента CGI языка программирования Ruby, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

Уязвимость ruby

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.