Vulnerabilities > CVE-2019-8322 - Injection vulnerability in multiple products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
low complexity
rubygems
debian
opensuse
CWE-74
nessus

Summary

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-1235.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324) * rubygems: Escape sequence injection vulnerability in gem owner (CVE-2019-8322) * rubygems: Escape sequence injection vulnerability in API response handling (CVE-2019-8323) * rubygems: Escape sequence injection vulnerability in errors (CVE-2019-8325) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id125201
    published2019-05-16
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125201
    titleRHEL 7 : ruby (RHSA-2019:1235)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2019:1235. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(125201);
      script_version("1.6");
      script_cvs_date("Date: 2020/01/15");
    
      script_cve_id("CVE-2019-8322", "CVE-2019-8323", "CVE-2019-8324", "CVE-2019-8325");
      script_xref(name:"RHSA", value:"2019:1235");
    
      script_name(english:"RHEL 7 : ruby (RHSA-2019:1235)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for ruby is now available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Ruby is an extensible, interpreted, object-oriented, scripting
    language. It has features to process text files and to perform system
    management tasks.
    
    Security Fix(es) :
    
    * rubygems: Installing a malicious gem may lead to arbitrary code
    execution (CVE-2019-8324)
    
    * rubygems: Escape sequence injection vulnerability in gem owner
    (CVE-2019-8322)
    
    * rubygems: Escape sequence injection vulnerability in API response
    handling (CVE-2019-8323)
    
    * rubygems: Escape sequence injection vulnerability in errors
    (CVE-2019-8325)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2019:1235"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-8322"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-8323"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-8324"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-8325"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ruby-tcltk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-bigdecimal");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-io-console");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-json");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-minitest");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-psych");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rake");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygem-rdoc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygems");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rubygems-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/05/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/16");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2019:1235";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"ruby-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ruby-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"ruby-debuginfo-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"ruby-devel-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ruby-devel-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"ruby-doc-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"ruby-irb-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"ruby-libs-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"ruby-tcltk-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ruby-tcltk-2.0.0.648-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"rubygem-bigdecimal-1.2.0-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-bigdecimal-1.2.0-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"rubygem-io-console-0.4.2-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-io-console-0.4.2-35.el7_6")) flag++;
    
      if (rpm_exists(rpm:"rubygem-json-1.7", release:"RHEL7") && rpm_check(release:"RHEL7", cpu:"s390x", reference:"rubygem-json-1.7.7-35.el7_6")) flag++;
    
      if (rpm_exists(rpm:"rubygem-json-1.7", release:"RHEL7") && rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-json-1.7.7-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"rubygem-minitest-4.3.2-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"rubygem-psych-2.0.0-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rubygem-psych-2.0.0-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"rubygem-rake-0.9.6-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"rubygem-rdoc-4.0.0-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"rubygems-2.0.14.1-35.el7_6")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"rubygems-devel-2.0.14.1-35.el7_6")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby / ruby-debuginfo / ruby-devel / ruby-doc / ruby-irb / etc");
      }
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-FEAC6674B7.NASL
    descriptionRebase to latest minor version fixes CVE-2019-8320 CVE-2019-8321 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124728
    published2019-05-10
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124728
    titleFedora 28 : ruby (2019-feac6674b7)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2019-feac6674b7.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(124728);
      script_version("1.5");
      script_cvs_date("Date: 2020/01/21");
    
      script_cve_id("CVE-2019-8320", "CVE-2019-8321", "CVE-2019-8322", "CVE-2019-8323", "CVE-2019-8324", "CVE-2019-8325");
      script_xref(name:"FEDORA", value:"2019-feac6674b7");
    
      script_name(english:"Fedora 28 : ruby (2019-feac6674b7)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Rebase to latest minor version fixes CVE-2019-8320 CVE-2019-8321
    CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2019-feac6674b7"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected ruby package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-8320");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:ruby");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:28");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/06");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/05/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/10");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^28([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 28", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC28", reference:"ruby-2.5.5-108.fc28")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1617.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.(CVE-2018-16395) - An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.(CVE-2018-16396) - ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.(CVE-2019-8322) - ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.(CVE-2019-8323) - ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.(CVE-2019-8324) - ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.(CVE-2019-8325) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id125569
    published2019-05-30
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125569
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : ruby (EulerOS-SA-2019-1617)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-A155364F3C.NASL
    descriptionRebase to latest minor version fixes CVE-2019-8320 CVE-2019-8321 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124574
    published2019-05-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124574
    titleFedora 29 : ruby (2019-a155364f3c)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2019-1255.NASL
    descriptionAn issue was discovered in RubyGems. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.(CVE-2019-8322) An issue was discovered in RubyGems. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.(CVE-2019-8323) An issue was discovered in RubyGems. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.(CVE-2019-8321) A Directory Traversal issue was discovered in RubyGems. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user
    last seen2020-06-01
    modified2020-06-02
    plugin id127811
    published2019-08-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127811
    titleAmazon Linux AMI : ruby20 / ruby21,ruby24 (ALAS-2019-1255)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1804-1.NASL
    descriptionThis update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3 : This release includes some bug fixes and some security fixes. Security issues fixed: CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1 : This release includes some bug fixes and some security fixes. Security issues fixed: CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) Multiple vulnerabilities in RubyGems were fixed : - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: Fixed Net::POPMail methods modify frozen literal when using default arg ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: Add a new helper for bundled ruby gems. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126617
    published2019-07-11
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126617
    titleSUSE SLED15 / SLES15 Security Update : ruby-bundled-gems-rpmhelper, ruby2.5 (SUSE-SU-2019:1804-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4433.NASL
    descriptionSeveral vulnerabilities have been discovered in the Rubygems included in the interpreter for the Ruby language, which may result in denial of service or the execution of arbitrary code.
    last seen2020-06-01
    modified2020-06-02
    plugin id124096
    published2019-04-17
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124096
    titleDebian DSA-4433-1 : ruby2.3 - security update
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0080_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ruby packages installed that are affected by multiple vulnerabilities: - An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. (CVE-2019-8322) - An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. (CVE-2019-8323) - An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check. (CVE-2019-8324) - An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) (CVE-2019-8325) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id127292
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127292
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : ruby Multiple Vulnerabilities (NS-SA-2019-0080)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1249.NASL
    descriptionAn issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. (CVE-2019-8322) An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. (CVE-2019-8323) An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) (CVE-2019-8325) An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check. (CVE-2019-8324)
    last seen2020-06-01
    modified2020-06-02
    plugin id126961
    published2019-07-24
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126961
    titleAmazon Linux 2 : ruby (ALAS-2019-1249)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1597.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324) - rubygems: Escape sequence injection vulnerability in gem owner (CVE-2019-8322) - rubygems: Escape sequence injection vulnerability in API response handling (CVE-2019-8323) - rubygems: Escape sequence injection vulnerability in errors (CVE-2019-8325) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-05-29
    plugin id125524
    published2019-05-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125524
    titleEulerOS 2.0 SP5 : ruby (EulerOS-SA-2019-1597)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-1235.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324) * rubygems: Escape sequence injection vulnerability in gem owner (CVE-2019-8322) * rubygems: Escape sequence injection vulnerability in API response handling (CVE-2019-8323) * rubygems: Escape sequence injection vulnerability in errors (CVE-2019-8325) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id125316
    published2019-05-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125316
    titleCentOS 7 : ruby (CESA-2019:1235)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1718.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324) - rubygems: Escape sequence injection vulnerability in gem owner (CVE-2019-8322) - rubygems: Escape sequence injection vulnerability in API response handling (CVE-2019-8323) - rubygems: Escape sequence injection vulnerability in errors (CVE-2019-8325) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-07-22
    plugin id126846
    published2019-07-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126846
    titleEulerOS 2.0 SP2 : ruby (EulerOS-SA-2019-1718)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0084_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ruby packages installed that are affected by multiple vulnerabilities: - An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. (CVE-2019-8322) - An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. (CVE-2019-8323) - An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check. (CVE-2019-8324) - An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) (CVE-2019-8325) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id127299
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127299
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : ruby Multiple Vulnerabilities (NS-SA-2019-0084)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1735.NASL
    descriptionSeveral vulnerabilities have been discovered in rubygems embedded in ruby2.1, the interpreted scripting language. CVE-2019-8320 A Directory Traversal issue was discovered in RubyGems. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. CVE-2019-8322 The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. CVE-2019-8323 Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. CVE-2019-8324 A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check. CVE-2019-8325 An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id123522
    published2019-04-01
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123522
    titleDebian DLA-1735-1 : ruby2.1 security update
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_27B12D04472211E98B7CB5E01141761F.NASL
    descriptionRubyGems Security Advisories : CVE-2019-8320: Delete directory using symlink when decompressing tar CVE-2019-8321: Escape sequence injection vulnerability in
    last seen2020-06-01
    modified2020-06-02
    plugin id122883
    published2019-03-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122883
    titleFreeBSD : RubyGems -- multiple vulnerabilities (27b12d04-4722-11e9-8b7c-b5e01141761f)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2019-1235.NASL
    descriptionFrom Red Hat Security Advisory 2019:1235 : An update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324) * rubygems: Escape sequence injection vulnerability in gem owner (CVE-2019-8322) * rubygems: Escape sequence injection vulnerability in API response handling (CVE-2019-8323) * rubygems: Escape sequence injection vulnerability in errors (CVE-2019-8325) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id125191
    published2019-05-16
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125191
    titleOracle Linux 7 : ruby (ELSA-2019-1235)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1796.NASL
    descriptionMultiple vulnerabilities have been discovered in jruby, Java implementation of the Ruby programming language. CVE-2018-1000074 Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file CVE-2018-1000075 an infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop CVE-2018-1000076 Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures. CVE-2018-1000077 Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server CVE-2019-8321 Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible CVE-2019-8322 The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur CVE-2019-8323 Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. CVE-2019-8324 A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec CVE-2019-8325 Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id125297
    published2019-05-21
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125297
    titleDebian DLA-1796-1 : jruby security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1771.NASL
    descriptionThis update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed : - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3 : This release includes some bug fixes and some security fixes. Security issues fixed : - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1 : This release includes some bug fixes and some security fixes. Security issues fixed : - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed : - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes : - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper : - Add a new helper for bundled ruby gems. This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id126904
    published2019-07-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126904
    titleopenSUSE Security Update : ruby-bundled-gems-rpmhelper / ruby2.5 (openSUSE-2019-1771)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190515_RUBY_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324) - rubygems: Escape sequence injection vulnerability in gem owner (CVE-2019-8322) - rubygems: Escape sequence injection vulnerability in API response handling (CVE-2019-8323) - rubygems: Escape sequence injection vulnerability in errors (CVE-2019-8325)
    last seen2020-03-18
    modified2019-05-16
    plugin id125208
    published2019-05-16
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125208
    titleScientific Linux Security Update : ruby on SL7.x x86_64 (20190515)

Redhat

rpms
  • ruby-0:2.5.5-105.module+el8.1.0+3656+f80bfa1d
  • ruby-debuginfo-0:2.5.5-105.module+el8.1.0+3656+f80bfa1d
  • ruby-debugsource-0:2.5.5-105.module+el8.1.0+3656+f80bfa1d
  • ruby-devel-0:2.5.5-105.module+el8.1.0+3656+f80bfa1d
  • ruby-doc-0:2.5.5-105.module+el8.1.0+3656+f80bfa1d
  • ruby-irb-0:2.5.5-105.module+el8.1.0+3656+f80bfa1d
  • ruby-libs-0:2.5.5-105.module+el8.1.0+3656+f80bfa1d
  • ruby-libs-debuginfo-0:2.5.5-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-abrt-0:0.3.0-4.module+el8.1.0+3656+f80bfa1d
  • rubygem-abrt-doc-0:0.3.0-4.module+el8.1.0+3656+f80bfa1d
  • rubygem-bigdecimal-0:1.3.4-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-bigdecimal-debuginfo-0:1.3.4-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-bson-0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-bson-debuginfo-0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-bson-debugsource-0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-bson-doc-0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-bundler-0:1.16.1-3.module+el8.1.0+3656+f80bfa1d
  • rubygem-bundler-doc-0:1.16.1-3.module+el8.1.0+3656+f80bfa1d
  • rubygem-did_you_mean-0:1.2.0-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-io-console-0:0.4.6-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-io-console-debuginfo-0:0.4.6-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-json-0:2.1.0-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-json-debuginfo-0:2.1.0-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-minitest-0:5.10.3-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-mongo-0:2.5.1-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-mongo-doc-0:2.5.1-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-mysql2-0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
  • rubygem-mysql2-debuginfo-0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
  • rubygem-mysql2-debugsource-0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
  • rubygem-mysql2-doc-0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
  • rubygem-net-telnet-0:0.1.1-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-openssl-0:2.1.2-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-openssl-debuginfo-0:2.1.2-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-pg-0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-pg-debuginfo-0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-pg-debugsource-0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-pg-doc-0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
  • rubygem-power_assert-0:1.1.1-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-psych-0:3.0.2-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-psych-debuginfo-0:3.0.2-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-rake-0:12.3.0-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-rdoc-0:6.0.1-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-test-unit-0:3.2.7-105.module+el8.1.0+3656+f80bfa1d
  • rubygem-xmlrpc-0:0.3.0-105.module+el8.1.0+3656+f80bfa1d
  • rubygems-0:2.7.6.2-105.module+el8.1.0+3656+f80bfa1d
  • rubygems-devel-0:2.7.6.2-105.module+el8.1.0+3656+f80bfa1d
  • rh-ruby25-ruby-0:2.5.5-7.el7
  • rh-ruby25-ruby-debuginfo-0:2.5.5-7.el7
  • rh-ruby25-ruby-devel-0:2.5.5-7.el7
  • rh-ruby25-ruby-doc-0:2.5.5-7.el7
  • rh-ruby25-ruby-irb-0:2.5.5-7.el7
  • rh-ruby25-ruby-libs-0:2.5.5-7.el7
  • rh-ruby25-rubygem-bigdecimal-0:1.3.4-7.el7
  • rh-ruby25-rubygem-did_you_mean-0:1.2.0-7.el7
  • rh-ruby25-rubygem-io-console-0:0.4.6-7.el7
  • rh-ruby25-rubygem-json-0:2.1.0-7.el7
  • rh-ruby25-rubygem-minitest-0:5.10.3-7.el7
  • rh-ruby25-rubygem-net-telnet-0:0.1.1-7.el7
  • rh-ruby25-rubygem-openssl-0:2.1.2-7.el7
  • rh-ruby25-rubygem-power_assert-0:1.1.1-7.el7
  • rh-ruby25-rubygem-psych-0:3.0.2-7.el7
  • rh-ruby25-rubygem-rake-0:12.3.0-7.el7
  • rh-ruby25-rubygem-rdoc-0:6.0.1-7.el7
  • rh-ruby25-rubygem-test-unit-0:3.2.7-7.el7
  • rh-ruby25-rubygem-xmlrpc-0:0.3.0-7.el7
  • rh-ruby25-rubygems-0:2.7.6.2-7.el7
  • rh-ruby25-rubygems-devel-0:2.7.6.2-7.el7
  • rh-ruby24-ruby-0:2.4.6-92.el6
  • rh-ruby24-ruby-0:2.4.6-92.el7
  • rh-ruby24-ruby-debuginfo-0:2.4.6-92.el6
  • rh-ruby24-ruby-debuginfo-0:2.4.6-92.el7
  • rh-ruby24-ruby-devel-0:2.4.6-92.el6
  • rh-ruby24-ruby-devel-0:2.4.6-92.el7
  • rh-ruby24-ruby-doc-0:2.4.6-92.el6
  • rh-ruby24-ruby-doc-0:2.4.6-92.el7
  • rh-ruby24-ruby-irb-0:2.4.6-92.el6
  • rh-ruby24-ruby-irb-0:2.4.6-92.el7
  • rh-ruby24-ruby-libs-0:2.4.6-92.el6
  • rh-ruby24-ruby-libs-0:2.4.6-92.el7
  • rh-ruby24-rubygem-bigdecimal-0:1.3.2-92.el6
  • rh-ruby24-rubygem-bigdecimal-0:1.3.2-92.el7
  • rh-ruby24-rubygem-did_you_mean-0:1.1.0-92.el6
  • rh-ruby24-rubygem-did_you_mean-0:1.1.0-92.el7
  • rh-ruby24-rubygem-io-console-0:0.4.6-92.el6
  • rh-ruby24-rubygem-io-console-0:0.4.6-92.el7
  • rh-ruby24-rubygem-json-0:2.0.4-92.el6
  • rh-ruby24-rubygem-json-0:2.0.4-92.el7
  • rh-ruby24-rubygem-minitest-0:5.10.1-92.el6
  • rh-ruby24-rubygem-minitest-0:5.10.1-92.el7
  • rh-ruby24-rubygem-net-telnet-0:0.1.1-92.el6
  • rh-ruby24-rubygem-net-telnet-0:0.1.1-92.el7
  • rh-ruby24-rubygem-openssl-0:2.0.9-92.el6
  • rh-ruby24-rubygem-openssl-0:2.0.9-92.el7
  • rh-ruby24-rubygem-power_assert-0:0.4.1-92.el6
  • rh-ruby24-rubygem-power_assert-0:0.4.1-92.el7
  • rh-ruby24-rubygem-psych-0:2.2.2-92.el6
  • rh-ruby24-rubygem-psych-0:2.2.2-92.el7
  • rh-ruby24-rubygem-rake-0:12.0.0-92.el6
  • rh-ruby24-rubygem-rake-0:12.0.0-92.el7
  • rh-ruby24-rubygem-rdoc-0:5.0.0-92.el6
  • rh-ruby24-rubygem-rdoc-0:5.0.0-92.el7
  • rh-ruby24-rubygem-test-unit-0:3.2.3-92.el6
  • rh-ruby24-rubygem-test-unit-0:3.2.3-92.el7
  • rh-ruby24-rubygem-xmlrpc-0:0.2.1-92.el6
  • rh-ruby24-rubygem-xmlrpc-0:0.2.1-92.el7
  • rh-ruby24-rubygems-0:2.6.14.4-92.el6
  • rh-ruby24-rubygems-0:2.6.14.4-92.el7
  • rh-ruby24-rubygems-devel-0:2.6.14.4-92.el6
  • rh-ruby24-rubygems-devel-0:2.6.14.4-92.el7
  • ruby-0:2.0.0.648-35.el7_6
  • ruby-debuginfo-0:2.0.0.648-35.el7_6
  • ruby-devel-0:2.0.0.648-35.el7_6
  • ruby-doc-0:2.0.0.648-35.el7_6
  • ruby-irb-0:2.0.0.648-35.el7_6
  • ruby-libs-0:2.0.0.648-35.el7_6
  • ruby-tcltk-0:2.0.0.648-35.el7_6
  • rubygem-bigdecimal-0:1.2.0-35.el7_6
  • rubygem-io-console-0:0.4.2-35.el7_6
  • rubygem-json-0:1.7.7-35.el7_6
  • rubygem-minitest-0:4.3.2-35.el7_6
  • rubygem-psych-0:2.0.0-35.el7_6
  • rubygem-rake-0:0.9.6-35.el7_6
  • rubygem-rdoc-0:4.0.0-35.el7_6
  • rubygems-0:2.0.14.1-35.el7_6
  • rubygems-devel-0:2.0.14.1-35.el7_6
  • cfme-0:5.10.5.1-1.el7cf
  • cfme-amazon-smartstate-0:5.10.5.1-1.el7cf
  • cfme-appliance-0:5.10.5.1-1.el7cf
  • cfme-appliance-common-0:5.10.5.1-1.el7cf
  • cfme-appliance-debuginfo-0:5.10.5.1-1.el7cf
  • cfme-appliance-tools-0:5.10.5.1-1.el7cf
  • cfme-debuginfo-0:5.10.5.1-1.el7cf
  • cfme-gemset-0:5.10.5.1-1.el7cf
  • cfme-gemset-debuginfo-0:5.10.5.1-1.el7cf
  • ruby-0:2.4.6-91.el7cf
  • ruby-debuginfo-0:2.4.6-91.el7cf
  • ruby-devel-0:2.4.6-91.el7cf
  • ruby-doc-0:2.4.6-91.el7cf
  • ruby-irb-0:2.4.6-91.el7cf
  • ruby-libs-0:2.4.6-91.el7cf
  • rubygem-bigdecimal-0:1.3.2-91.el7cf
  • rubygem-did_you_mean-0:1.1.0-91.el7cf
  • rubygem-io-console-0:0.4.6-91.el7cf
  • rubygem-minitest-0:5.10.1-91.el7cf
  • rubygem-net-telnet-0:0.1.1-91.el7cf
  • rubygem-openssl-0:2.0.9-91.el7cf
  • rubygem-power_assert-0:0.4.1-91.el7cf
  • rubygem-psych-0:2.2.2-91.el7cf
  • rubygem-rake-0:12.0.0-91.el7cf
  • rubygem-rdoc-0:5.0.0-91.el7cf
  • rubygem-test-unit-0:3.2.3-91.el7cf
  • rubygem-xmlrpc-0:0.2.1-91.el7cf
  • rubygems-0:2.6.14.4-91.el7cf
  • rubygems-devel-0:2.6.14.4-91.el7cf