Skip to content

Commit d462817

Browse files
yousyous
committed
Import original articles
1 parent f423d6a commit d462817

7 files changed

+315
-0
lines changed

‎ko/news/_posts/2019-10-01-code-injection-shell-test-cve-2019-16255.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2019-16255: A code injection vulnerability of Shell#[] and Shell#test"
4+
author: "mame"
5+
translator:
6+
date: 2019-10-01 11:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
A code injection vulnerability of Shell#[] and Shell#test in a standard library (lib/shell.rb) was found. The vulnerability has been assigned the CVE identifier [CVE-2019-16255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16255).
12+
13+
## Details
14+
15+
Shell#[] and its alias Shell#test defined in lib/shell.rb allow code injection if the first argument (aka the "command" argument) is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
16+
17+
Note that passing untrusted data to methods of Shell is dangerous in general. Users must never do it. However, we treat this particular case as a vulnerability because the purpose of Shell#[] and Shell#test is considered file testing.
18+
19+
All users running an affected release should upgrade immediately.
20+
21+
## Affected Versions
22+
23+
* All releases that are Ruby 2.3 or earlier
24+
* Ruby 2.4 series: Ruby 2.4.7 or earlier
25+
* Ruby 2.5 series: Ruby 2.5.6 or earlier
26+
* Ruby 2.6 series: Ruby 2.6.4 or earlier
27+
* Ruby 2.7.0-preview1
28+
29+
## Acknowledgement
30+
31+
Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for discovering this issue.
32+
33+
## History
34+
35+
* Originally published at 2019-10-01 11:00:00 (UTC)
36+
* Fixed minor spelling problem at 2019-10-05 12:00:00 (UTC)

‎ko/news/_posts/2019-10-01-http-response-splitting-in-webrick-cve-2019-16254.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)"
4+
author: "mame"
5+
translator:
6+
date: 2019-10-01 11:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
There is an HTTP response splitting vulnerability in WEBrick bundled with Ruby. This vulnerability has been assigned the CVE identifier [CVE-2019-16254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16254).
12+
13+
## Details
14+
15+
If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients.
16+
17+
This is the same issue as [CVE-2017-17742](https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/). The previous fix was incomplete, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
18+
19+
All users running an affected release should upgrade immediately.
20+
21+
## Affected Versions
22+
23+
* All releases that are Ruby 2.3 or earlier
24+
* Ruby 2.4 series: Ruby 2.4.7 or earlier
25+
* Ruby 2.5 series: Ruby 2.5.6 or earlier
26+
* Ruby 2.6 series: Ruby 2.6.4 or earlier
27+
* Ruby 2.7.0-preview1
28+
* prior to master commit 3ce238b5f9795581eb84114dcfbdf4aa086bfecc
29+
30+
## Acknowledgement
31+
32+
Thanks to [znz](https://hackerone.com/znz) for discovering this issue.
33+
34+
## History
35+
36+
* Originally published at 2019-10-01 11:00:00 (UTC)

‎ko/news/_posts/2019-10-01-nul-injection-file-fnmatch-cve-2019-15845.md

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch?"
4+
author: "mame"
5+
translator:
6+
date: 2019-10-01 11:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
A NUL injection vulnerability of Ruby built-in methods (`File.fnmatch` and `File.fnmatch?`) was found. An attacker who has the control of the path pattern parameter could exploit this vulnerability to make path matching pass despite the intention of the program author.
12+
[CVE-2019-15845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15845) has been assigned to this vulnerability.
13+
14+
## Details
15+
16+
Built-in methods `File.fnmatch` and its alias `File.fnmatch?` accept the path pattern as their first parameter. When the pattern contains NUL character (`\0`), the methods recognize that the path pattern ends immediately before the NUL byte. Therefore, a script that uses an external input as the pattern argument, an attacker can make it wrongly match a pathname that is the second parameter.
17+
18+
All users running any affected releases should upgrade as soon as possible.
19+
20+
## Affected Versions
21+
22+
* All releases that are Ruby 2.3 or earlier
23+
* Ruby 2.4 series: Ruby 2.4.7 or earlier
24+
* Ruby 2.5 series: Ruby 2.5.6 or earlier
25+
* Ruby 2.6 series: Ruby 2.6.4 or earlier
26+
* Ruby 2.7.0-preview1
27+
* prior to master commit a0a2640b398cffd351f87d3f6243103add66575b
28+
29+
## Acknowledgement
30+
31+
Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for discovering this issue.
32+
33+
## History
34+
35+
* Originally published at 2019-10-01 11:00:00 (UTC)

‎ko/news/_posts/2019-10-01-ruby-2-4-8-released.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.4.8 Released"
4+
author: "usa"
5+
translator:
6+
date: 2019-10-01 11:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.4.8 has been released.
11+
12+
This release includes security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2019-16255: A code injection vulnerability of Shell#[] and Shell#test]({% link en/news/_posts/2019-10-01-code-injection-shell-test-cve-2019-16255.md %})
16+
* [CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)]({% link en/news/_posts/2019-10-01-http-response-splitting-in-webrick-cve-2019-16254.md %})
17+
* [CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch?]({% link en/news/_posts/2019-10-01-nul-injection-file-fnmatch-cve-2019-15845.md %})
18+
* [CVE-2019-16201: Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication]({% link en/news/_posts/2019-10-01-webrick-regexp-digestauth-dos-cve-2019-16201.md %})
19+
20+
Ruby 2.4 is now under the state of the security maintenance phase, until
21+
the end of March of 2020. After that date, maintenance of Ruby 2.4
22+
will be ended. We recommend you start planning the migration to newer
23+
versions of Ruby, such as 2.6 or 2.5.
24+
25+
__Update (Oct 2nd 4:00 UTC):__ We're working on the issue that the Ruby 2.4.8 release tarball doesn't install under _non-root_ user. Follow [[Bug #16197]](https://bugs.ruby-lang.org/issues/16197) for detailed updates.
26+
27+
## Download
28+
29+
{% assign release = site.data.releases | where: "version", "2.4.8" | first %}
30+
31+
* <{{ release.url.bz2 }}>
32+
33+
SIZE: {{ release.size.bz2 }}
34+
SHA1: {{ release.sha1.bz2 }}
35+
SHA256: {{ release.sha256.bz2 }}
36+
SHA512: {{ release.sha512.bz2 }}
37+
38+
* <{{ release.url.gz }}>
39+
40+
SIZE: {{ release.size.gz }}
41+
SHA1: {{ release.sha1.gz }}
42+
SHA256: {{ release.sha256.gz }}
43+
SHA512: {{ release.sha512.gz }}
44+
45+
* <{{ release.url.xz }}>
46+
47+
SIZE: {{ release.size.xz }}
48+
SHA1: {{ release.sha1.xz }}
49+
SHA256: {{ release.sha256.xz }}
50+
SHA512: {{ release.sha512.xz }}
51+
52+
* <{{ release.url.zip }}>
53+
54+
SIZE: {{ release.size.zip }}
55+
SHA1: {{ release.sha1.zip }}
56+
SHA256: {{ release.sha256.zip }}
57+
SHA512: {{ release.sha512.zip }}
58+
59+
## Release Comment
60+
61+
Thanks to everyone who helped with this release, especially, to reporters of the vulnerability.

‎ko/news/_posts/2019-10-01-ruby-2-5-7-released.md

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.5.7 Released"
4+
author: "usa"
5+
translator:
6+
date: 2019-10-01 11:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.5.7 has been released.
11+
12+
This release includes security fixes as listed below.
13+
Please check the topics below for details.
14+
15+
* [CVE-2019-16255: A code injection vulnerability of Shell#[] and Shell#test]({% link en/news/_posts/2019-10-01-code-injection-shell-test-cve-2019-16255.md %})
16+
* [CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)]({% link en/news/_posts/2019-10-01-http-response-splitting-in-webrick-cve-2019-16254.md %})
17+
* [CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch?]({% link en/news/_posts/2019-10-01-nul-injection-file-fnmatch-cve-2019-15845.md %})
18+
* [CVE-2019-16201: Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication]({% link en/news/_posts/2019-10-01-webrick-regexp-digestauth-dos-cve-2019-16201.md %})
19+
20+
See the [commit log](https://github.com/ruby/ruby/compare/v2_5_6...v2_5_7) for details.
21+
22+
## Download
23+
24+
{% assign release = site.data.releases | where: "version", "2.5.7" | first %}
25+
26+
* <{{ release.url.bz2 }}>
27+
28+
SIZE: {{ release.size.bz2 }}
29+
SHA1: {{ release.sha1.bz2 }}
30+
SHA256: {{ release.sha256.bz2 }}
31+
SHA512: {{ release.sha512.bz2 }}
32+
33+
* <{{ release.url.gz }}>
34+
35+
SIZE: {{ release.size.gz }}
36+
SHA1: {{ release.sha1.gz }}
37+
SHA256: {{ release.sha256.gz }}
38+
SHA512: {{ release.sha512.gz }}
39+
40+
* <{{ release.url.xz }}>
41+
42+
SIZE: {{ release.size.xz }}
43+
SHA1: {{ release.sha1.xz }}
44+
SHA256: {{ release.sha256.xz }}
45+
SHA512: {{ release.sha512.xz }}
46+
47+
* <{{ release.url.zip }}>
48+
49+
SIZE: {{ release.size.zip }}
50+
SHA1: {{ release.sha1.zip }}
51+
SHA256: {{ release.sha256.zip }}
52+
SHA512: {{ release.sha512.zip }}
53+
54+
## Release Comment
55+
56+
Thanks to everyone who helped with this release.
57+
58+
The maintenance of Ruby 2.5, including this release, is based on the "Agreement for the Ruby stable version" of the Ruby Association.

‎ko/news/_posts/2019-10-01-ruby-2-6-5-released.md

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
layout: news_post
3+
title: "Ruby 2.6.5 Released"
4+
author: "nagachika"
5+
translator:
6+
date: 2019-10-01 11:00:00 +0000
7+
lang: en
8+
---
9+
10+
Ruby 2.6.5 has been released.
11+
12+
This release includes security fixes.
13+
Please check the topics below for details.
14+
15+
* [CVE-2019-16255: A code injection vulnerability of Shell#[] and Shell#test]({% link en/news/_posts/2019-10-01-code-injection-shell-test-cve-2019-16255.md %})
16+
* [CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)]({% link en/news/_posts/2019-10-01-http-response-splitting-in-webrick-cve-2019-16254.md %})
17+
* [CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch?]({% link en/news/_posts/2019-10-01-nul-injection-file-fnmatch-cve-2019-15845.md %})
18+
* [CVE-2019-16201: Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication]({% link en/news/_posts/2019-10-01-webrick-regexp-digestauth-dos-cve-2019-16201.md %})
19+
20+
See the [commit logs](https://github.com/ruby/ruby/compare/v2_6_4...v2_6_5) for changes in detail.
21+
22+
## Download
23+
24+
{% assign release = site.data.releases | where: "version", "2.6.5" | first %}
25+
26+
* <{{ release.url.bz2 }}>
27+
28+
SIZE: {{ release.size.bz2 }}
29+
SHA1: {{ release.sha1.bz2 }}
30+
SHA256: {{ release.sha256.bz2 }}
31+
SHA512: {{ release.sha512.bz2 }}
32+
33+
* <{{ release.url.gz }}>
34+
35+
SIZE: {{ release.size.gz }}
36+
SHA1: {{ release.sha1.gz }}
37+
SHA256: {{ release.sha256.gz }}
38+
SHA512: {{ release.sha512.gz }}
39+
40+
* <{{ release.url.xz }}>
41+
42+
SIZE: {{ release.size.xz }}
43+
SHA1: {{ release.sha1.xz }}
44+
SHA256: {{ release.sha256.xz }}
45+
SHA512: {{ release.sha512.xz }}
46+
47+
* <{{ release.url.zip }}>
48+
49+
SIZE: {{ release.size.zip }}
50+
SHA1: {{ release.sha1.zip }}
51+
SHA256: {{ release.sha256.zip }}
52+
SHA512: {{ release.sha512.zip }}
53+
54+
## Release Comment
55+
56+
Many committers, developers, and users who provided bug reports helped us make this release.
57+
Thanks for their contributions.

‎ko/news/_posts/2019-10-01-webrick-regexp-digestauth-dos-cve-2019-16201.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
layout: news_post
3+
title: "CVE-2019-16201: Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication"
4+
author: "mame"
5+
translator:
6+
date: 2019-10-01 11:00:00 +0000
7+
tags: security
8+
lang: en
9+
---
10+
11+
Regular expression denial of service vulnerability of WEBrick's Digest authentication module was found. An attacker can exploit this vulnerability to cause an effective denial of service against a WEBrick service.
12+
13+
[CVE-2019-16201](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16201) has been assigned to this vulnerability.
14+
15+
All users running any affected releases should upgrade as soon as possible.
16+
17+
## Affected Versions
18+
19+
* All releases that are Ruby 2.3 or earlier
20+
* Ruby 2.4 series: Ruby 2.4.7 or earlier
21+
* Ruby 2.5 series: Ruby 2.5.6 or earlier
22+
* Ruby 2.6 series: Ruby 2.6.4 or earlier
23+
* Ruby 2.7.0-preview1
24+
* prior to master commit 36e057e26ef2104bc2349799d6c52d22bb1c7d03
25+
26+
## Acknowledgement
27+
28+
Thanks to [358](https://hackerone.com/358) for discovering this issue.
29+
30+
## History
31+
32+
* Originally published at 2019-10-01 11:00:00 (UTC)

0 commit comments

Comments
 (0)