Red Hat: CVE-2018-1000074: Moderate: ruby security update (Multiple Advisories)
Description
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.
Solution(s)
- redhat-upgrade-ruby
- redhat-upgrade-ruby-debuginfo
- redhat-upgrade-ruby-devel
- redhat-upgrade-ruby-doc
- redhat-upgrade-ruby-irb
- redhat-upgrade-ruby-libs
- redhat-upgrade-ruby-tcltk
- redhat-upgrade-rubygem-bigdecimal
- redhat-upgrade-rubygem-io-console
- redhat-upgrade-rubygem-json
- redhat-upgrade-rubygem-minitest
- redhat-upgrade-rubygem-psych
- redhat-upgrade-rubygem-rake
- redhat-upgrade-rubygem-rdoc
- redhat-upgrade-rubygems
- redhat-upgrade-rubygems-devel
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center