USN-6055-2: Ruby regression

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• ruby2.3 - Object-oriented scripting language
• ruby2.5 - Object-oriented scripting language
• ruby2.7 - Object-oriented scripting language

Details

USN-6055-1 fixed a vulnerability in Ruby. Unfortunately it introduced a regression.
This update reverts the patches applied to CVE-2023-28755 in order to fix the regression
pending further investigation.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2023-28755)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• ruby2.7 - 2.7.0-5ubuntu1.10
• libruby2.7 - 2.7.0-5ubuntu1.10

Ubuntu 18.04

• ruby2.5 - 2.5.1-1ubuntu1.15
• libruby2.5 - 2.5.1-1ubuntu1.15

Ubuntu 16.04

• libruby2.3 - 2.3.1-2~ubuntu16.04.16+esm6
  Available with Ubuntu Pro
• ruby2.3 - 2.3.1-2~ubuntu16.04.16+esm6
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-28755
• https://launchpad.net/bugs/2018547

Related notices

• USN-6055-1: ruby2.3-dev, ruby2.5, ruby2.3-tcltk, ruby2.5-doc, ruby2.7-dev, ruby2.3, ruby2.5-dev, ruby2.7-doc, libruby2.7, libruby2.3, ruby2.3-doc, ruby2.7, libruby2.5
• USN-6087-1: ruby2.3-dev, ruby2.5, ruby2.3-tcltk, ruby2.5-doc, ruby2.7-dev, ruby2.3, ruby2.5-dev, ruby2.7-doc, libruby2.7, libruby2.3, ruby2.3-doc, ruby2.7, libruby2.5
• USN-6181-1: ruby3.1-dev, ruby3.1-doc, libruby3.1, ruby3.1
• USN-6219-1: libruby2.3, ruby2.3-doc, ruby2.3-dev, ruby3.1-dev, ruby2.5-doc, ruby2.5-dev, libruby3.1, ruby3.0, ruby2.5, ruby3.0-doc, ruby2.7-doc, ruby3.0-dev, ruby3.1, ruby2.7-dev, ruby3.1-doc, ruby2.3-tcltk, ruby2.3, libruby2.7, ruby2.7, libruby3.0, libruby2.5