Linux · Security advisory · July 15, 2024

ELSA-2024-4499: Security update for 32 packages

ELSA-2024-4499, released July 15, 2024, fixes 5 CVEs across 32 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
5
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0236
83rd percentile

Priority of the 5 CVEs

Patch now 0 Urgent 1 High 1 Routine 3

Fixed package versions

ProductReleaseFixed in
rubyol 80:2.5.9-112.module+el8.10.0+90367+ae9e8511
ruby-develol 80:2.5.9-112.module+el8.10.0+90367+ae9e8511
ruby-docol 80:2.5.9-112.module+el8.10.0+90367+ae9e8511
ruby-irbol 80:2.5.9-112.module+el8.10.0+90367+ae9e8511
ruby-libsol 80:2.5.9-112.module+el8.10.0+90367+ae9e8511
rubygem-abrtol 80:0.3.0-4.module+el8.10.0+90367+ae9e8511
rubygem-abrt-docol 80:0.3.0-4.module+el8.10.0+90367+ae9e8511
rubygem-bigdecimalol 80:1.3.4-112.module+el8.10.0+90367+ae9e8511
rubygem-bsonol 80:4.3.0-2.module+el8.9.0+90042+a65659a6
rubygem-bson-docol 80:4.3.0-2.module+el8.9.0+90042+a65659a6
rubygem-bundlerol 80:1.16.1-4.module+el8.10.0+90367+ae9e8511
rubygem-bundler-docol 80:1.16.1-4.module+el8.10.0+90367+ae9e8511
rubygem-did_you_meanol 80:1.2.0-112.module+el8.10.0+90367+ae9e8511
rubygem-io-consoleol 80:0.4.6-112.module+el8.10.0+90367+ae9e8511
rubygem-jsonol 80:2.1.0-112.module+el8.10.0+90367+ae9e8511
rubygem-minitestol 80:5.10.3-112.module+el8.10.0+90367+ae9e8511
rubygem-mongool 80:2.5.1-2.module+el8.9.0+90042+a65659a6
rubygem-mongo-docol 80:2.5.1-2.module+el8.9.0+90042+a65659a6
rubygem-mysql2ol 80:0.4.10-4.module+el8.9.0+90042+a65659a6
rubygem-mysql2-docol 80:0.4.10-4.module+el8.9.0+90042+a65659a6
rubygem-net-telnetol 80:0.1.1-112.module+el8.10.0+90367+ae9e8511
rubygem-opensslol 80:2.1.2-112.module+el8.10.0+90367+ae9e8511
rubygem-pgol 80:1.0.0-3.module+el8.9.0+90042+a65659a6
rubygem-pg-docol 80:1.0.0-3.module+el8.9.0+90042+a65659a6
rubygem-power_assertol 80:1.1.1-112.module+el8.10.0+90367+ae9e8511
rubygem-psychol 80:3.0.2-112.module+el8.10.0+90367+ae9e8511
rubygem-rakeol 80:12.3.3-112.module+el8.10.0+90367+ae9e8511
rubygem-rdocol 80:6.0.1.1-112.module+el8.10.0+90367+ae9e8511
rubygem-test-unitol 80:3.2.7-112.module+el8.10.0+90367+ae9e8511
rubygem-xmlrpcol 80:0.3.0-112.module+el8.10.0+90367+ae9e8511
rubygemsol 80:2.7.6.3-112.module+el8.10.0+90367+ae9e8511
rubygems-develol 80:2.7.6.3-112.module+el8.10.0+90367+ae9e8511

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2024-27280 Ruby: Processing a file may lead to a denial-of-service or potentially disclose memory contents 9.8 0.0236 None reported
High CVE-2023-36617 ruby: Ruby is an extensible, interpreted, object-oriented, scripting language 8.8 0.0170 None reported
Routine CVE-2024-35176 ruby2.5: This update for ruby2.5 fixes the following issues: - CVE-2024-43398: Fixed DoS when parsing a XML that has many dee... 5.3 0.0206 None reported
Routine CVE-2024-27281 ruby: Ruby is an extensible, interpreted, object-oriented, scripting language 6.6 0.0157 None reported
Routine CVE-2024-27282 ruby: Ruby is an extensible, interpreted, object-oriented, scripting language 6.6 0.0066 None reported
Showing 1 to 5 of 5 1