USN-4922-2: Ruby vulnerability

26 April 2021

Ruby incorrectly handled XML documents.

Releases

Packages

  • ruby2.7 - Object-oriented scripting language

Details

USN-4922-1 fixed a vulnerability in Ruby. This update provides the
corresponding update for Ubuntu 21.04.

Original advisory details:

Juho Nurminen discovered that the REXML gem bundled with Ruby incorrectly
parsed and serialized XML documents. A remote attacker could possibly use
this issue to perform an XML round-trip attack.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.04

In general, a standard system update will make all the necessary changes.

References

Related notices

  • USN-4922-1: ruby2.3-tcltk, libruby2.5, ruby2.7, ruby2.3-doc, ruby2.7-dev, ruby2.3-dev, ruby2.5-dev, ruby2.7-doc, ruby2.3, ruby2.5-doc, libruby2.7, ruby2.5, libruby2.3