{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2018-8778: fix buffer under-read in String#unpack\n- CVE-2018-16396: propagate taint flags in Array#pack and String#unpack\n- CVE-2018-8780: reject NUL bytes in Dir paths\n- CVE-2018-16395: fix OpenSSL::X509::Name equality check\n- CVE-2015-1855: make OpenSSL hostname matching follow RFC 6125\n- CVE-2018-8777: fix DoS by large request in WEBrick\n- CVE-2019-16201: fix ReDoS in WEBrick Digest authentication\n- CVE-2020-25613: fix HTTP request smuggling in WEBrick\n- CVE-2021-41819: fix cookie prefix spoofing in CGI::Cookie.parse\n- CVE-2025-27219: fix DoS in CGI::Cookie.parse\n- CVE-2021-33621: fix HTTP response splitting in CGI\n- CVE-2025-27220: fix ReDoS in CGI::Util#escapeElement\n- CVE-2018-6914: fix directory traversal in Tempfile and Dir.mktmpdir\n- CVE-2019-16255: fix code injection in Shell#[] and Shell#test\n- CVE-2021-41817: fix ReDoS in Date parsing methods\n- CVE-2026-80212: fix unbounded class registration for unknown DNS types\n- CVE-2021-28965: fix XML round-trip issue in REXML\n- CVE-2024-49761: fix ReDoS in REXML", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/advisories/2026/clsa-2026_1793084071.json" } ], "tracking": { "current_release_date": "2026-10-27T06:57:38Z", "generator": { "date": "2026-10-27T06:57:38Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793084071", "initial_release_date": "2026-10-27T06:57:38Z", "revision_history": [ { "date": "2026-10-27T06:57:38Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "ruby: Fix of 18 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 6", "product": { "name": "Oracle Linux 6", "product_id": "Oracle-Linux-6", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-docs@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-rdoc@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-tcltk@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-devel@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-ri@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-libs@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-static@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product": { "name": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_id": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-irb@1.8.7.374-5.el6.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-docs@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-rdoc@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-tcltk@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-devel@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-ri@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-libs@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-static@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product": { "name": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_id": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/ruby-irb@1.8.7.374-5.el6.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686" }, "product_reference": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" }, "product_reference": "ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-6914", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2018-6914" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/103686", "url": "http://www.securityfocus.com/bid/103686" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1042004", "url": "http://www.securitytracker.com/id/1042004" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3729", "url": "https://access.redhat.com/errata/RHSA-2018:3729" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3730", "url": "https://access.redhat.com/errata/RHSA-2018:3730" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3731", "url": "https://access.redhat.com/errata/RHSA-2018:3731" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2028", "url": "https://access.redhat.com/errata/RHSA-2019:2028" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html" }, { "category": "external", "summary": "https://usn.ubuntu.com/3626-1/", "url": "https://usn.ubuntu.com/3626-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2018/dsa-4259", "url": "https://www.debian.org/security/2018/dsa-4259" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/" } ], "release_date": "2018-04-03T22:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2019-16201", "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "notes": [ { "category": "description", "text": "WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2019-16201" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html" }, { "category": "external", "summary": "https://hackerone.com/reports/661722", "url": "https://hackerone.com/reports/661722" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html", "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html", "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html", "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html", "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Dec/31", "url": "https://seclists.org/bugtraq/2019/Dec/31" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Dec/32", "url": "https://seclists.org/bugtraq/2019/Dec/32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202003-06", "url": "https://security.gentoo.org/glsa/202003-06" }, { "category": "external", "summary": "https://www.debian.org/security/2019/dsa-4587", "url": "https://www.debian.org/security/2019/dsa-4587" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujan2020.html", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" } ], "release_date": "2019-11-26T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2018-8777", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2018-8777" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/103683", "url": "http://www.securityfocus.com/bid/103683" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1042004", "url": "http://www.securitytracker.com/id/1042004" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3729", "url": "https://access.redhat.com/errata/RHSA-2018:3729" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3730", "url": "https://access.redhat.com/errata/RHSA-2018:3730" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3731", "url": "https://access.redhat.com/errata/RHSA-2018:3731" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2028", "url": "https://access.redhat.com/errata/RHSA-2019:2028" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0542", "url": "https://access.redhat.com/errata/RHSA-2020:0542" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0591", "url": "https://access.redhat.com/errata/RHSA-2020:0591" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0663", "url": "https://access.redhat.com/errata/RHSA-2020:0663" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html" }, { "category": "external", "summary": "https://usn.ubuntu.com/3685-1/", "url": "https://usn.ubuntu.com/3685-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2018/dsa-4259", "url": "https://www.debian.org/security/2018/dsa-4259" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/" } ], "release_date": "2018-04-03T22:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-33621", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" }, "notes": [ { "category": "description", "text": "The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-33621" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html", "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-27", "url": "https://security.gentoo.org/glsa/202401-27" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221228-0004/", "url": "https://security.netapp.com/advisory/ntap-20221228-0004/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/", "url": "https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html", "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html" } ], "release_date": "2022-11-18T23:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2018-16395", "notes": [ { "category": "description", "text": "An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2018-16395" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1042105", "url": "http://www.securitytracker.com/id/1042105" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3729", "url": "https://access.redhat.com/errata/RHSA-2018:3729" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3730", "url": "https://access.redhat.com/errata/RHSA-2018:3730" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3731", "url": "https://access.redhat.com/errata/RHSA-2018:3731" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3738", "url": "https://access.redhat.com/errata/RHSA-2018:3738" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1948", "url": "https://access.redhat.com/errata/RHSA-2019:1948" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2565", "url": "https://access.redhat.com/errata/RHSA-2019:2565" }, { "category": "external", "summary": "https://hackerone.com/reports/387250", "url": "https://hackerone.com/reports/387250" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html", "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20190221-0002/", "url": "https://security.netapp.com/advisory/ntap-20190221-0002/" }, { "category": "external", "summary": "https://usn.ubuntu.com/3808-1/", "url": "https://usn.ubuntu.com/3808-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2018/dsa-4332", "url": "https://www.debian.org/security/2018/dsa-4332" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujan2020.html", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/", "url": "https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/", "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/", "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/", "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/", "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/" } ], "release_date": "2018-11-16T18:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2018-8778", "cwe": { "id": "CWE-134", "name": "Use of Externally-Controlled Format String" }, "notes": [ { "category": "description", "text": "In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2018-8778" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/103693", "url": "http://www.securityfocus.com/bid/103693" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1042004", "url": "http://www.securitytracker.com/id/1042004" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3729", "url": "https://access.redhat.com/errata/RHSA-2018:3729" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3730", "url": "https://access.redhat.com/errata/RHSA-2018:3730" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3731", "url": "https://access.redhat.com/errata/RHSA-2018:3731" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2028", "url": "https://access.redhat.com/errata/RHSA-2019:2028" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html" }, { "category": "external", "summary": "https://usn.ubuntu.com/3626-1/", "url": "https://usn.ubuntu.com/3626-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2018/dsa-4259", "url": "https://www.debian.org/security/2018/dsa-4259" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/" } ], "release_date": "2018-04-03T22:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-41817", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "notes": [ { "category": "description", "text": "Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-41817" }, { "category": "external", "summary": "https://hackerone.com/reports/1254844", "url": "https://hackerone.com/reports/1254844" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-27", "url": "https://security.gentoo.org/glsa/202401-27" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/", "url": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/" } ], "release_date": "2022-01-01T05:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2019-16255", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "notes": [ { "category": "description", "text": "Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the \"command\" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2019-16255" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html" }, { "category": "external", "summary": "https://hackerone.com/reports/327512", "url": "https://hackerone.com/reports/327512" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html", "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html", "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html", "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html", "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Dec/31", "url": "https://seclists.org/bugtraq/2019/Dec/31" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Dec/32", "url": "https://seclists.org/bugtraq/2019/Dec/32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202003-06", "url": "https://security.gentoo.org/glsa/202003-06" }, { "category": "external", "summary": "https://www.debian.org/security/2019/dsa-4587", "url": "https://www.debian.org/security/2019/dsa-4587" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujan2020.html", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "category": "external", "summary": "https://www.ruby-lang.org/ja/news/2019/10/01/code-injection-shell-test-cve-2019-16255/", "url": "https://www.ruby-lang.org/ja/news/2019/10/01/code-injection-shell-test-cve-2019-16255/" }, { "category": "external", "summary": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/", "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/", "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/", "url": "https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/" } ], "release_date": "2019-11-26T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80212", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80212" }, { "category": "external", "summary": "https://github.com/ruby/resolv", "url": "https://github.com/ruby/resolv" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/", "url": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/" } ], "release_date": "2026-08-27T17:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2021-28965", "notes": [ { "category": "description", "text": "The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-28965" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20210528-0003/", "url": "https://security.netapp.com/advisory/ntap-20210528-0003/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/", "url": "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/" } ], "release_date": "2021-04-21T07:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-49761", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "notes": [ { "category": "description", "text": "REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-49761" }, { "category": "external", "summary": "https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f", "url": "https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f" }, { "category": "external", "summary": "https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m", "url": "https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761", "url": "https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20241227-0004/", "url": "https://security.netapp.com/advisory/ntap-20241227-0004/" } ], "release_date": "2024-10-28T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2020-25613", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" }, "notes": [ { "category": "description", "text": "An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2020-25613" }, { "category": "external", "summary": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7", "url": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7" }, { "category": "external", "summary": "https://hackerone.com/reports/965267", "url": "https://hackerone.com/reports/965267" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html", "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFP3E7KXXT3H3KA6CBZPUOGA5VPFARRJ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTZURYROG3FFED3TYCQOBV66BS4K6WOV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-27", "url": "https://security.gentoo.org/glsa/202401-27" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20210115-0008/", "url": "https://security.netapp.com/advisory/ntap-20210115-0008/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/", "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/" } ], "release_date": "2020-10-06T13:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2015-1855", "notes": [ { "category": "description", "text": "verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2015-1855" } ], "release_date": "2019-11-29T20:46:48Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-27220", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "notes": [ { "category": "description", "text": "In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-27220" }, { "category": "external", "summary": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml" }, { "category": "external", "summary": "https://hackerone.com/reports/2890322", "url": "https://hackerone.com/reports/2890322" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html" } ], "release_date": "2025-03-04T00:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2018-16396", "notes": [ { "category": "description", "text": "An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2018-16396" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1042106", "url": "http://www.securitytracker.com/id/1042106" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3729", "url": "https://access.redhat.com/errata/RHSA-2018:3729" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3730", "url": "https://access.redhat.com/errata/RHSA-2018:3730" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3731", "url": "https://access.redhat.com/errata/RHSA-2018:3731" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2028", "url": "https://access.redhat.com/errata/RHSA-2019:2028" }, { "category": "external", "summary": "https://hackerone.com/reports/385070", "url": "https://hackerone.com/reports/385070" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html", "url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20190221-0002/", "url": "https://security.netapp.com/advisory/ntap-20190221-0002/" }, { "category": "external", "summary": "https://usn.ubuntu.com/3808-1/", "url": "https://usn.ubuntu.com/3808-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2018/dsa-4332", "url": "https://www.debian.org/security/2018/dsa-4332" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/", "url": "https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/", "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/", "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/", "url": "https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/", "url": "https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/" } ], "release_date": "2018-11-16T18:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-41819", "cwe": { "id": "CWE-565", "name": "Reliance on Cookies without Validation and Integrity Checking" }, "notes": [ { "category": "description", "text": "CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-41819" }, { "category": "external", "summary": "https://hackerone.com/reports/910552", "url": "https://hackerone.com/reports/910552" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202401-27", "url": "https://security.gentoo.org/glsa/202401-27" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20220121-0003/", "url": "https://security.netapp.com/advisory/ntap-20220121-0003/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/", "url": "https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/" } ], "release_date": "2022-01-01T06:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-27219", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-27219" }, { "category": "external", "summary": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml" }, { "category": "external", "summary": "https://hackerone.com/reports/2936778", "url": "https://hackerone.com/reports/2936778" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html" } ], "release_date": "2025-03-04T00:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2018-8780", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2018-8780" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/103739", "url": "http://www.securityfocus.com/bid/103739" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1042004", "url": "http://www.securitytracker.com/id/1042004" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3729", "url": "https://access.redhat.com/errata/RHSA-2018:3729" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3730", "url": "https://access.redhat.com/errata/RHSA-2018:3730" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3731", "url": "https://access.redhat.com/errata/RHSA-2018:3731" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2028", "url": "https://access.redhat.com/errata/RHSA-2019:2028" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0542", "url": "https://access.redhat.com/errata/RHSA-2020:0542" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0591", "url": "https://access.redhat.com/errata/RHSA-2020:0591" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0663", "url": "https://access.redhat.com/errata/RHSA-2020:0663" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html" }, { "category": "external", "summary": "https://usn.ubuntu.com/3626-1/", "url": "https://usn.ubuntu.com/3626-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2018/dsa-4259", "url": "https://www.debian.org/security/2018/dsa-4259" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/" }, { "category": "external", "summary": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/", "url": "https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/" } ], "release_date": "2018-04-03T22:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-27T06:54:32.904600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071", "product_ids": [ "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-devel-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-docs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-irb-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-libs-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-rdoc-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-ri-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-static-0:1.8.7.374-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.i686", "Oracle-Linux-6:ruby-tcltk-0:1.8.7.374-5.el6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793084071" } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }