{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-42246: fix Net::IMAP#starttls returning success without TLS\n on a man-in-the-middle error response\n- CVE-2026-42258: fix IMAP command injection via Symbol arguments", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/advisories/2026/clsa-2026_1792706124.json" } ], "tracking": { "current_release_date": "2026-10-24T09:27:47Z", "generator": { "date": "2026-10-24T09:27:47Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792706124", "initial_release_date": "2026-10-22T21:55:25Z", "revision_history": [ { "date": "2026-10-22T21:55:25Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-24T09:27:47Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "ruby: Fix of 19 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "product": { "name": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "product_id": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-io-console@0.4.2-39.el7_9.tuxcare.els15?arch=i686" } } }, { "category": "product_version", "name": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "product": { "name": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "product_id": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-bigdecimal@1.2.0-39.el7_9.tuxcare.els15?arch=i686" } } }, { "category": "product_version", "name": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "product": { "name": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "product_id": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-psych@2.0.0-39.el7_9.tuxcare.els15?arch=i686" } } }, { "category": "product_version", "name": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product": { "name": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product_id": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-libs@2.0.0.648-39.el7_9.tuxcare.els15?arch=i686" } } }, { "category": "product_version", "name": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product": { "name": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product_id": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby@2.0.0.648-39.el7_9.tuxcare.els15?arch=i686" } } }, { "category": "product_version", "name": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product": { "name": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product_id": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-devel@2.0.0.648-39.el7_9.tuxcare.els15?arch=i686" } } }, { "category": "product_version", "name": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product": { "name": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product_id": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-tcltk@2.0.0.648-39.el7_9.tuxcare.els15?arch=i686" } } }, { "category": "product_version", "name": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "product": { "name": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "product_id": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-json@1.7.7-39.el7_9.tuxcare.els15?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "product": { "name": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "product_id": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-io-console@0.4.2-39.el7_9.tuxcare.els15?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "product": { "name": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "product_id": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-bigdecimal@1.2.0-39.el7_9.tuxcare.els15?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "product": { "name": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "product_id": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-psych@2.0.0-39.el7_9.tuxcare.els15?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product": { "name": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product_id": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-libs@2.0.0.648-39.el7_9.tuxcare.els15?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product": { "name": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product_id": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby@2.0.0.648-39.el7_9.tuxcare.els15?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product": { "name": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product_id": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-devel@2.0.0.648-39.el7_9.tuxcare.els15?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product": { "name": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product_id": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-tcltk@2.0.0.648-39.el7_9.tuxcare.els15?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "product": { "name": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "product_id": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-json@1.7.7-39.el7_9.tuxcare.els15?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "product": { "name": "rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "product_id": "rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-rake@0.9.6-39.el7_9.tuxcare.els15?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "product": { "name": "rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "product_id": "rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-minitest@4.3.2-39.el7_9.tuxcare.els15?arch=noarch" } } }, { "category": "product_version", "name": "rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "product": { "name": "rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "product_id": "rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygems-devel@2.0.14.1-39.el7_9.tuxcare.els15?arch=noarch" } } }, { "category": "product_version", "name": "ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "product": { "name": "ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "product_id": "ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-irb@2.0.0.648-39.el7_9.tuxcare.els15?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "product": { "name": "rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "product_id": "rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygem-rdoc@4.0.0-39.el7_9.tuxcare.els15?arch=noarch" } } }, { "category": "product_version", "name": "ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "product": { "name": "ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "product_id": "ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-doc@2.0.0.648-39.el7_9.tuxcare.els15?arch=noarch" } } }, { "category": "product_version", "name": "rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "product": { "name": "rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "product_id": "rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/rubygems@2.0.14.1-39.el7_9.tuxcare.els15?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686" }, "product_reference": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64" }, "product_reference": "rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch" }, "product_reference": "rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch" }, "product_reference": "rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686" }, "product_reference": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64" }, "product_reference": "rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" }, "product_reference": "rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64" }, "product_reference": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686" }, "product_reference": "rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64" }, "product_reference": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686" }, "product_reference": "ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64" }, "product_reference": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686" }, "product_reference": "ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch" }, "product_reference": "ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch" }, "product_reference": "rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686" }, "product_reference": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64" }, "product_reference": "ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64" }, "product_reference": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686" }, "product_reference": "ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686" }, "product_reference": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64" }, "product_reference": "rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch" }, "product_reference": "ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch as a component of CloudLinux 7", "product_id": "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" }, "product_reference": "rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-9226", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2017-9226" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/101244", "url": "http://www.securityfocus.com/bid/101244" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:1296", "url": "https://access.redhat.com/errata/RHSA-2018:1296" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/commit/b4bf968ad52afe14e60a2dc8a95d3555c543353a", "url": "https://github.com/kkos/oniguruma/commit/b4bf968ad52afe14e60a2dc8a95d3555c543353a" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/commit/f015fbdd95f76438cd86366467bb2b39870dd7c6", "url": "https://github.com/kkos/oniguruma/commit/f015fbdd95f76438cd86366467bb2b39870dd7c6" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/issues/55", "url": "https://github.com/kkos/oniguruma/issues/55" } ], "release_date": "2017-05-24T15:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-27820", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "description", "text": "zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-27820" }, { "category": "external", "summary": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w", "url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w" }, { "category": "external", "summary": "https://hackerone.com/reports/3467067", "url": "https://hackerone.com/reports/3467067" } ], "release_date": "2026-04-16T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2021-31799", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "description", "text": "In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-31799" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html", "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html" }, { "category": "external", "summary": "https://security-tracker.debian.org/tracker/CVE-2021-31799", "url": "https://security-tracker.debian.org/tracker/CVE-2021-31799" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-05", "url": "https://security.gentoo.org/glsa/202401-05" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20210902-0004/", "url": "https://security.netapp.com/advisory/ntap-20210902-0004/" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuapr2022.html", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/", "url": "https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/" } ], "release_date": "2021-07-30T14:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2016-2339", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "An exploitable heap overflow vulnerability exists in the Fiddle::Function.new \"initialize\" function functionality of Ruby. In Fiddle::Function.new \"initialize\" heap buffer \"arg_types\" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2016-2339" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/91234", "url": "http://www.securityfocus.com/bid/91234" }, { "category": "external", "summary": "http://www.talosintelligence.com/reports/TALOS-2016-0034/", "url": "http://www.talosintelligence.com/reports/TALOS-2016-0034/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html" } ], "release_date": "2017-01-06T21:59:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2017-9224", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2017-9224" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/101244", "url": "http://www.securityfocus.com/bid/101244" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:1296", "url": "https://access.redhat.com/errata/RHSA-2018:1296" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/commit/690313a061f7a4fa614ec5cc8368b4f2284e059b", "url": "https://github.com/kkos/oniguruma/commit/690313a061f7a4fa614ec5cc8368b4f2284e059b" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/issues/57", "url": "https://github.com/kkos/oniguruma/issues/57" } ], "release_date": "2017-05-24T15:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2016-2338", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer \"head\" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2016-2338" }, { "category": "external", "summary": "http://www.talosintelligence.com/reports/TALOS-2016-0032/", "url": "http://www.talosintelligence.com/reports/TALOS-2016-0032/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html", "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221228-0005/", "url": "https://security.netapp.com/advisory/ntap-20221228-0005/" } ], "release_date": "2022-09-29T03:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2017-9227", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2017-9227" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/100538", "url": "http://www.securityfocus.com/bid/100538" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:1296", "url": "https://access.redhat.com/errata/RHSA-2018:1296" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/commit/9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814", "url": "https://github.com/kkos/oniguruma/commit/9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/issues/58", "url": "https://github.com/kkos/oniguruma/issues/58" } ], "release_date": "2017-05-24T15:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2022-28739", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-28739" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/28", "url": "http://seclists.org/fulldisclosure/2022/Oct/28" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/29", "url": "http://seclists.org/fulldisclosure/2022/Oct/29" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/30", "url": "http://seclists.org/fulldisclosure/2022/Oct/30" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/41", "url": "http://seclists.org/fulldisclosure/2022/Oct/41" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/42", "url": "http://seclists.org/fulldisclosure/2022/Oct/42" }, { "category": "external", "summary": "https://hackerone.com/reports/1248108", "url": "https://hackerone.com/reports/1248108" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html", "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html" }, { "category": "external", "summary": "https://security-tracker.debian.org/tracker/CVE-2022-28739", "url": "https://security-tracker.debian.org/tracker/CVE-2022-28739" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-27", "url": "https://security.gentoo.org/glsa/202401-27" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20220624-0002/", "url": "https://security.netapp.com/advisory/ntap-20220624-0002/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213488", "url": "https://support.apple.com/kb/HT213488" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213493", "url": "https://support.apple.com/kb/HT213493" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213494", "url": "https://support.apple.com/kb/HT213494" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/", "url": "https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html", "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html" } ], "release_date": "2022-05-09T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-41817", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "notes": [ { "category": "description", "text": "Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-41817" }, { "category": "external", "summary": "https://hackerone.com/reports/1254844", "url": "https://hackerone.com/reports/1254844" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-27", "url": "https://security.gentoo.org/glsa/202401-27" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/", "url": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/" } ], "release_date": "2022-01-01T05:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2016-2337", "notes": [ { "category": "description", "text": "Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as \"retval\" argument can cause arbitrary code execution.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2016-2337" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/91233", "url": "http://www.securityfocus.com/bid/91233" }, { "category": "external", "summary": "http://www.talosintelligence.com/reports/TALOS-2016-0031/", "url": "http://www.talosintelligence.com/reports/TALOS-2016-0031/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00028.html" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/201710-18", "url": "https://security.gentoo.org/glsa/201710-18" } ], "release_date": "2017-01-06T21:59:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-80212", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80212" }, { "category": "external", "summary": "https://github.com/ruby/resolv", "url": "https://github.com/ruby/resolv" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/", "url": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/" } ], "release_date": "2026-08-27T17:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2021-28965", "notes": [ { "category": "description", "text": "The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-28965" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20210528-0003/", "url": "https://security.netapp.com/advisory/ntap-20210528-0003/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/", "url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/" } ], "release_date": "2021-04-21T07:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-49761", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "notes": [ { "category": "description", "text": "REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-49761" }, { "category": "external", "summary": "https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f", "url": "https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f" }, { "category": "external", "summary": "https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m", "url": "https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761", "url": "https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20241227-0004/", "url": "https://security.netapp.com/advisory/ntap-20241227-0004/" } ], "release_date": "2024-10-28T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2017-9228", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2017-9228" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:1296", "url": "https://access.redhat.com/errata/RHSA-2018:1296" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/commit/3b63d12038c8d8fc278e81c942fa9bec7c704c8b", "url": "https://github.com/kkos/oniguruma/commit/3b63d12038c8d8fc278e81c942fa9bec7c704c8b" }, { "category": "external", "summary": "https://github.com/kkos/oniguruma/issues/60", "url": "https://github.com/kkos/oniguruma/issues/60" } ], "release_date": "2017-05-24T15:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2021-32066", "cwe": { "id": "CWE-755", "name": "Improper Handling of Exceptional Conditions" }, "notes": [ { "category": "description", "text": "An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a \"StartTLS stripping attack.\"", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-32066" }, { "category": "external", "summary": "https://github.com/ruby/ruby/commit/a21a3b7d23704a01d34bd79d09dc37897e00922a", "url": "https://github.com/ruby/ruby/commit/a21a3b7d23704a01d34bd79d09dc37897e00922a" }, { "category": "external", "summary": "https://hackerone.com/reports/1178562", "url": "https://hackerone.com/reports/1178562" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html", "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00009.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html", "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-27", "url": "https://security.gentoo.org/glsa/202401-27" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20210902-0004/", "url": "https://security.netapp.com/advisory/ntap-20210902-0004/" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuapr2022.html", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/", "url": "https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/" } ], "release_date": "2021-08-01T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-27220", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "notes": [ { "category": "description", "text": "In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-27220" }, { "category": "external", "summary": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml" }, { "category": "external", "summary": "https://hackerone.com/reports/2890322", "url": "https://hackerone.com/reports/2890322" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html" } ], "release_date": "2025-03-04T00:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-41819", "cwe": { "id": "CWE-565", "name": "Reliance on Cookies without Validation and Integrity Checking" }, "notes": [ { "category": "description", "text": "CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-41819" }, { "category": "external", "summary": "https://hackerone.com/reports/910552", "url": "https://hackerone.com/reports/910552" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-27", "url": "https://security.gentoo.org/glsa/202401-27" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20220121-0003/", "url": "https://security.netapp.com/advisory/ntap-20220121-0003/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/", "url": "https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/" } ], "release_date": "2022-01-01T06:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-27219", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-27219" }, { "category": "external", "summary": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml" }, { "category": "external", "summary": "https://hackerone.com/reports/2936778", "url": "https://hackerone.com/reports/2936778" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html" } ], "release_date": "2025-03-04T00:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-42246", "cwe": { "id": "CWE-392", "name": "Missing Report of Error Condition" }, "notes": [ { "category": "description", "text": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return \"successfully\", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-42246" }, { "category": "external", "summary": "https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618", "url": "https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618" }, { "category": "external", "summary": "https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e", "url": "https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e" }, { "category": "external", "summary": "https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c", "url": "https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c" }, { "category": "external", "summary": "https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da", "url": "https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da" }, { "category": "external", "summary": "https://github.com/ruby/net-imap/releases/tag/v0.3.10", "url": "https://github.com/ruby/net-imap/releases/tag/v0.3.10" }, { "category": "external", "summary": "https://github.com/ruby/net-imap/releases/tag/v0.4.24", "url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24" }, { "category": "external", "summary": "https://github.com/ruby/net-imap/releases/tag/v0.5.14", "url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14" }, { "category": "external", "summary": "https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp", "url": "https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33462", "url": "https://access.redhat.com/errata/RHSA-2026:33462" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33512", "url": "https://access.redhat.com/errata/RHSA-2026:33512" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33514", "url": "https://access.redhat.com/errata/RHSA-2026:33514" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33515", "url": "https://access.redhat.com/errata/RHSA-2026:33515" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33540", "url": "https://access.redhat.com/errata/RHSA-2026:33540" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33551", "url": "https://access.redhat.com/errata/RHSA-2026:33551" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33552", "url": "https://access.redhat.com/errata/RHSA-2026:33552" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33565", "url": "https://access.redhat.com/errata/RHSA-2026:33565" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33576", "url": "https://access.redhat.com/errata/RHSA-2026:33576" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33577", "url": "https://access.redhat.com/errata/RHSA-2026:33577" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33630", "url": "https://access.redhat.com/errata/RHSA-2026:33630" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33721", "url": "https://access.redhat.com/errata/RHSA-2026:33721" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:34076", "url": "https://access.redhat.com/errata/RHSA-2026:34076" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35834", "url": "https://access.redhat.com/errata/RHSA-2026:35834" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35866", "url": "https://access.redhat.com/errata/RHSA-2026:35866" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35867", "url": "https://access.redhat.com/errata/RHSA-2026:35867" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35895", "url": "https://access.redhat.com/errata/RHSA-2026:35895" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36099", "url": "https://access.redhat.com/errata/RHSA-2026:36099" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:37238", "url": "https://access.redhat.com/errata/RHSA-2026:37238" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:37397", "url": "https://access.redhat.com/errata/RHSA-2026:37397" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-42246", "url": "https://access.redhat.com/security/cve/CVE-2026-42246" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2468499", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468499" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42246.json" } ], "release_date": "2026-05-09T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-22T21:55:25.668133Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124", "product_ids": [ "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-devel-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-doc-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-irb-0:2.0.0.648-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-libs-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:ruby-tcltk-0:2.0.0.648-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-bigdecimal-0:1.2.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-io-console-0:0.4.2-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-json-0:1.7.7-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-minitest-0:4.3.2-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.i686", "CloudLinux-7:rubygem-psych-0:2.0.0-39.el7_9.tuxcare.els15.x86_64", "CloudLinux-7:rubygem-rake-0:0.9.6-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygem-rdoc-0:4.0.0-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch", "CloudLinux-7:rubygems-devel-0:2.0.14.1-39.el7_9.tuxcare.els15.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792706124" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }