SB2020070915 - Red Hat Enterprise Linux 7 update for ruby
Published: July 9, 2020
Security Bulletin ID
SB2020070915
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Security restrictions bypass (CVE-ID: CVE-2018-16396)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to the tainted flags are not propagated with the
B, b, H, and h directives. A remote attacker can supply inputs by Array#pack and/or String#unpack with these directives and checks the reliability with tainted flags and cause the check to be wrong to bypass security restrictions and conduct further attacks.Remediation
Install update from vendor's website.