Ubuntu Security Notice 3808-1 - It was discovered that Ruby incorrectly handled certain X.509 certificates. An attacker could possibly use this issue to bypass the certificate check. It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code.
dc2d5b3f5be433cc29a21366af2eda8167a7638d8db5ae80699233902daf3800
==========================================================================
Ubuntu Security Notice USN-3808-1
November 05, 2018
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Ruby.
Software Description:
- ruby2.5: Interpreter of object-oriented scripting language Ruby
- ruby2.3: Object-oriented scripting language
- ruby1.9.1: Object-oriented scripting language
- ruby2.0: Object-oriented scripting language
Details:
It was discovered that Ruby incorrectly handled certain X.509
certificates. An attacker could possibly use this issue to
bypass the certificate check. (CVE-2018-16395)
It was discovered that Ruby incorrectly handled certain
inputs. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2018-16396)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
libruby2.5 2.5.1-5ubuntu4.1
ruby2.5 2.5.1-5ubuntu4.1
Ubuntu 18.04 LTS:
libruby2.5 2.5.1-1ubuntu1.1
ruby2.5 2.5.1-1ubuntu1.1
Ubuntu 16.04 LTS:
libruby2.3 2.3.1-2~16.04.11
ruby2.3 2.3.1-2~16.04.11
Ubuntu 14.04 LTS:
libruby1.9.1 1.9.3.484-2ubuntu1.13
libruby2.0 2.0.0.484-1ubuntu2.11
ruby1.9.1 1.9.3.484-2ubuntu1.13
ruby1.9.3 1.9.3.484-2ubuntu1.13
ruby2.0 2.0.0.484-1ubuntu2.11
In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3808-1
CVE-2018-16395, CVE-2018-16396
Package Information:
https://launchpad.net/ubuntu/+source/ruby2.5/2.5.1-5ubuntu4.1
https://launchpad.net/ubuntu/+source/ruby2.5/2.5.1-1ubuntu1.1
https://launchpad.net/ubuntu/+source/ruby2.3/2.3.1-2~16.04.11
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-2ubuntu1.13
https://launchpad.net/ubuntu/+source/ruby2.0/2.0.0.484-1ubuntu2.11