@@ -17,28 +17,30 @@ The following vulnerabilites have been reported.
17
17
18
18
* a DNS request hijacking vulnerability
19
19
* an ANSI escape sequence vulnerability
20
- * a DOS vulernerability in the query command
20
+ * a DoS vulernerability in the query command
21
21
* a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files
22
22
23
23
It is strongly recommended for Ruby users to take one of the following workarounds as soon as possible.
24
24
25
25
## Affected Versions
26
26
27
- * Ruby 2.2.7 and all versions of Ruby 2.2 prior to it
28
- * Ruby 2.3.4 and all versions of Ruby 2.3 prior to it
29
- * Ruby 2.4.1 and all versions of Ruby 2.4 prior to it
27
+ * Ruby 2.2 series: 2.2.7 and earlier
28
+ * Ruby 2.3 series: 2.3.4 and earlier
29
+ * Ruby 2.4 series: 2.4.1 and earlier
30
30
* prior to trunk revision 59672
31
31
32
32
## Workarounds
33
33
34
- At this time, the fixed versions of Ruby have not been released yet.
35
- But you can upgrade RubyGems to latest version (2.6.13 or later), then the vulnerabilites will be fixed.
34
+ At this moment, there are no Ruby releases including the fix for RubyGems.
35
+ But you can upgrade RubyGems to the latest version.
36
+ RubyGems 2.6.13 or later includes the fix for the vulnerabilities.
37
+
36
38
37
39
```
38
40
gem update --system
39
41
```
40
42
41
- If you can not upgrade RubyGems, the following patches can be applied as workarounds .
43
+ If you can't upgrade RubyGems, you can apply the following patches as a workaround .
42
44
For Ruby 2.4.1, apply the two patches one by one.
43
45
44
46
* [ for Ruby 2.2.7] ( https://bugs.ruby-lang.org/attachments/download/6690/rubygems-2613-ruby22.patch )
0 commit comments