USN-6087-1: Ruby vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• ruby2.3 - Object-oriented scripting language
• ruby2.5 - Object-oriented scripting language
• ruby2.7 - Object-oriented scripting language

Details

It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2023-28755)

It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possily use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 ESM. (CVE-2023-28756)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• ruby2.7 - 2.7.0-5ubuntu1.11
• libruby2.7 - 2.7.0-5ubuntu1.11

Ubuntu 18.04

• ruby2.5 - 2.5.1-1ubuntu1.16
• libruby2.5 - 2.5.1-1ubuntu1.16

Ubuntu 16.04

• libruby2.3 - 2.3.1-2~ubuntu16.04.16+esm7
  Available with Ubuntu Pro
• ruby2.3 - 2.3.1-2~ubuntu16.04.16+esm7
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-28756
• CVE-2023-28755

Related notices

• USN-6055-1: ruby2.7-doc, ruby2.7, libruby2.3, ruby2.5-dev, ruby2.5-doc, ruby2.3-tcltk, ruby2.5, libruby2.5, ruby2.3-dev, ruby2.3-doc, ruby2.3, ruby2.7-dev, libruby2.7
• USN-6181-1: ruby3.1, libruby3.1, ruby3.1-dev, ruby3.1-doc
• USN-6055-2: ruby2.7-doc, ruby2.7, libruby2.3, ruby2.5-dev, ruby2.5-doc, ruby2.3-tcltk, ruby2.5, libruby2.5, ruby2.3-dev, ruby2.3-doc, ruby2.3, ruby2.7-dev, libruby2.7
• USN-6219-1: libruby3.1, libruby3.0, ruby2.5-dev, ruby2.5-doc, ruby2.5, libruby2.5, ruby3.1-doc, ruby2.7-doc, ruby2.7, libruby2.3, ruby3.1, ruby3.0-dev, ruby3.0-doc, ruby2.3-dev, ruby2.3-doc, ruby2.3, libruby2.7, ruby3.1-dev, ruby2.3-tcltk, ruby3.0, ruby2.7-dev