Linux · Security advisory · August 6, 2021

ELSA-2021-3020: Security update for 31 packages

ELSA-2021-3020, released August 6, 2021, fixes 4 CVEs across 31 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0631
93rd percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
rubyol 80:2.7.4-137.module+el8.4.0+20269+fcbf533e
ruby-default-gemsol 80:2.7.4-137.module+el8.4.0+20269+fcbf533e
ruby-develol 80:2.7.4-137.module+el8.4.0+20269+fcbf533e
ruby-docol 80:2.7.4-137.module+el8.4.0+20269+fcbf533e
ruby-libsol 80:2.7.4-137.module+el8.4.0+20269+fcbf533e
rubygem-abrtol 80:0.4.0-1.module+el8.3.0+7760+537395ec
rubygem-abrt-docol 80:0.4.0-1.module+el8.3.0+7760+537395ec
rubygem-bigdecimalol 80:2.0.0-137.module+el8.4.0+20269+fcbf533e
rubygem-bsonol 80:4.8.1-1.module+el8.4.0+20239+cbf59dc8
rubygem-bson-docol 80:4.8.1-1.module+el8.4.0+20239+cbf59dc8
rubygem-bundlerol 80:2.2.24-137.module+el8.4.0+20269+fcbf533e
rubygem-io-consoleol 80:0.5.6-137.module+el8.4.0+20269+fcbf533e
rubygem-irbol 80:1.2.6-137.module+el8.4.0+20269+fcbf533e
rubygem-jsonol 80:2.3.0-137.module+el8.4.0+20269+fcbf533e
rubygem-minitestol 80:5.13.0-137.module+el8.4.0+20269+fcbf533e
rubygem-mongool 80:2.11.3-1.module+el8.3.0+7760+537395ec
rubygem-mongo-docol 80:2.11.3-1.module+el8.3.0+7760+537395ec
rubygem-mysql2ol 80:0.5.3-1.module+el8.4.0+20239+cbf59dc8
rubygem-mysql2-docol 80:0.5.3-1.module+el8.4.0+20239+cbf59dc8
rubygem-net-telnetol 80:0.2.0-137.module+el8.4.0+20269+fcbf533e
rubygem-opensslol 80:2.1.2-137.module+el8.4.0+20269+fcbf533e
rubygem-pgol 80:1.2.3-1.module+el8.4.0+20239+cbf59dc8
rubygem-pg-docol 80:1.2.3-1.module+el8.4.0+20239+cbf59dc8
rubygem-power_assertol 80:1.1.7-137.module+el8.4.0+20269+fcbf533e
rubygem-psychol 80:3.1.0-137.module+el8.4.0+20269+fcbf533e
rubygem-rakeol 80:13.0.1-137.module+el8.4.0+20269+fcbf533e
rubygem-rdocol 80:6.2.1.1-137.module+el8.4.0+20269+fcbf533e
rubygem-test-unitol 80:3.3.4-137.module+el8.4.0+20269+fcbf533e
rubygem-xmlrpcol 80:0.3.0-137.module+el8.4.0+20269+fcbf533e
rubygemsol 80:3.1.6-137.module+el8.4.0+20269+fcbf533e
rubygems-develol 80:3.1.6-137.module+el8.4.0+20269+fcbf533e

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2020-36327 rubygem-bundler: This update for rubygem-bundler fixes the following issues: - CVE-2020-36327: Fixed bundler choosing a dependency so... 8.8 0.0631 None reported
High CVE-2021-31810 ruby: Ruby is an extensible, interpreted, object-oriented, scripting language 7.4 0.0305 None reported
High CVE-2021-32066 ruby: Ruby is an extensible, interpreted, object-oriented, scripting language 7.4 0.0291 None reported
High CVE-2021-31799 ruby-devel: Ruby is an extensible, interpreted, object-oriented, scripting language 7.4 0.0148 None reported
Showing 1 to 4 of 4 1