Linux · Security advisory · September 15, 2022

ELSA-2022-6450: Security update for 28 packages

ELSA-2022-6450, released September 15, 2022, fixes 4 CVEs across 28 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0437
91st percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
rubyol 80:3.0.4-141.module+el8.6.0+20741+4fdba061
ruby-default-gemsol 80:3.0.4-141.module+el8.6.0+20741+4fdba061
ruby-develol 80:3.0.4-141.module+el8.6.0+20741+4fdba061
ruby-docol 80:3.0.4-141.module+el8.6.0+20741+4fdba061
ruby-libsol 80:3.0.4-141.module+el8.6.0+20741+4fdba061
rubygem-abrtol 80:0.4.0-1.module+el8.5.0+20321+0ba6c954
rubygem-abrt-docol 80:0.4.0-1.module+el8.5.0+20321+0ba6c954
rubygem-bigdecimalol 80:3.0.0-141.module+el8.6.0+20741+4fdba061
rubygem-bundlerol 80:2.2.33-141.module+el8.6.0+20741+4fdba061
rubygem-io-consoleol 80:0.5.7-141.module+el8.6.0+20741+4fdba061
rubygem-irbol 80:1.3.5-141.module+el8.6.0+20741+4fdba061
rubygem-jsonol 80:2.5.1-141.module+el8.6.0+20741+4fdba061
rubygem-minitestol 80:5.14.2-141.module+el8.6.0+20741+4fdba061
rubygem-mysql2ol 80:0.5.3-1.module+el8.5.0+20321+0ba6c954
rubygem-mysql2-docol 80:0.5.3-1.module+el8.5.0+20321+0ba6c954
rubygem-pgol 80:1.2.3-1.module+el8.5.0+20321+0ba6c954
rubygem-pg-docol 80:1.2.3-1.module+el8.5.0+20321+0ba6c954
rubygem-power_assertol 80:1.2.0-141.module+el8.6.0+20741+4fdba061
rubygem-psychol 80:3.3.2-141.module+el8.6.0+20741+4fdba061
rubygem-rakeol 80:13.0.3-141.module+el8.6.0+20741+4fdba061
rubygem-rbsol 80:1.4.0-141.module+el8.6.0+20741+4fdba061
rubygem-rdocol 80:6.3.3-141.module+el8.6.0+20741+4fdba061
rubygem-rexmlol 80:3.2.5-141.module+el8.6.0+20741+4fdba061
rubygem-rssol 80:0.2.9-141.module+el8.6.0+20741+4fdba061
rubygem-test-unitol 80:3.3.7-141.module+el8.6.0+20741+4fdba061
rubygem-typeprofol 80:0.15.2-141.module+el8.6.0+20741+4fdba061
rubygemsol 80:3.2.33-141.module+el8.6.0+20741+4fdba061
rubygems-develol 80:3.2.33-141.module+el8.6.0+20741+4fdba061

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-28739 ruby: Ruby is an extensible, interpreted, object-oriented, scripting language 8.8 0.0437 None reported
High CVE-2021-41817 ruby: Ruby is an extensible, interpreted, object-oriented, scripting language 7.7 0.0346 None reported
High CVE-2021-41819 ruby: Ruby is an extensible, interpreted, object-oriented, scripting language 7.7 0.0315 None reported
High CVE-2022-28738 libruby3.0: A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2 9.8 0.0314 None reported
Showing 1 to 4 of 4 1