ASA-202107-25 log generated external raw

[ASA-202107-25] ruby2.6: multiple issues
Arch Linux Security Advisory ASA-202107-25 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 Package : ruby2.6 Type : multiple issues Remote : Yes Link : Summary ======= The package ruby2.6 before version 2.6.8-1 is vulnerable to multiple issues including silent downgrade, arbitrary command execution and information disclosure. Resolution ========== Upgrade to 2.6.8-1. # pacman -Syu "ruby2.6>=2.6.8-1" The problems have been fixed upstream in version 2.6.8. Workaround ========== None. Description =========== - CVE-2021-31799 (arbitrary command execution) RDoc before version 6.3.1, as bundled with Ruby before version 2.7.4 and 2.6.8 as well as GitLab before version 14.0.2, used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with "|" and ends with "tags", the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run the rdoc command. - CVE-2021-31810 (information disclosure) A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). - CVE-2021-32066 (silent downgrade) A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack”. Impact ====== A remote man-in-the-middle attacker could strip StartTLS encryption from IMAP connections to disclose authentication credentials and emails. Furthermore, a malicious FTP server could induce connections to an arbitrary IP address and port on a client, leading to potential information disclosure. References ==========