USN-4922-2: Ruby vulnerability
26 April 2021
Ruby incorrectly handled XML documents.
Releases
Packages
- ruby2.7 - Object-oriented scripting language
Details
USN-4922-1 fixed a vulnerability in Ruby. This update provides the
corresponding update for Ubuntu 21.04.
Original advisory details:
Juho Nurminen discovered that the REXML gem bundled with Ruby incorrectly
parsed and serialized XML documents. A remote attacker could possibly use
this issue to perform an XML round-trip attack.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-4922-1: libruby2.5, libruby2.7, libruby2.3, ruby2.7-dev, ruby2.7, ruby2.5-doc, ruby2.3-doc, ruby2.3-tcltk, ruby2.3, ruby2.7-doc, ruby2.5-dev, ruby2.3-dev, ruby2.5