Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.3260 Multiple jQuery vulnerabilities in RDoc 29 August 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Ruby Publisher: Ruby Operating System: Windows UNIX variants (UNIX, Linux, OSX) Impact/Access: Cross-site Scripting -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2015-9251 CVE-2012-6708 Reference: ESB-2019.1299 ESB-2018.2225 Original Bulletin: https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/ - --------------------------BEGIN INCLUDED TEXT-------------------- Multiple jQuery vulnerabilities in RDoc Posted by aycabta on 28 Aug 2019 There are multiple vulnerabilities about Cross-Site Scripting (XSS) in jQuery shipped with RDoc which bundled in Ruby. All Ruby users are recommended to update Ruby to the latest release which includes the fixed version of RDoc. Details The following vulnerabilities have been reported. o CVE-2012-6708 o CVE-2015-9251 It is strongly recommended for all Ruby users to upgrade your Ruby installation or take one of the following workarounds as soon as possible. You also have to re-generate existing RDoc documentations to completely mitigate the vulnerabilities. Affected Versions o Ruby 2.3 series: all o Ruby 2.4 series: 2.4.6 and earlier o Ruby 2.5 series: 2.5.5 and earlier o Ruby 2.6 series: 2.6.3 and earlier o prior to master commit f308ab2131ee675000926540cbb8c13c91dc3be5 Required actions RDoc is a static documentation generation tool. Patching the tool itself is insufficient to mitigate these vulnerabilities. So, RDoc documentations generated with previous versions have to be re-generated with newer RDoc. Workarounds In principle, you should upgrade your Ruby installation to the latest version. RDoc 6.1.2 or later includes the fix for the vulnerabilities, so upgrade RDoc to the latest version if you can t upgrade Ruby itself. Note that as mentioned earlier, you have to regenerate existing RDoc documentations. gem install rdoc -f Update: The initial version of this post partially mentioned rdoc-6.1.1.gem, which was still vulnerable. Please make sure that you install rdoc-6.1.2 or later. Regarding the development version, update to the latest HEAD of master branch. Credits Thanks to Chris Seaton for reporting the issue. History o Originally published at 2019-08-28 09:00:00 UTC o RDoc version fixed at 2019-08-28 11:50:00 UTC o Minor language fixes at 2019-08-28 12:30:00 UTC - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXWcZnGaOgq3Tt24GAQh3YRAA0X8yMNp5zrBNxZXPl5ya4rukSsaZmxi1 hqZutm5rydk3Ij7yLMNREShhK9eyjwx01CmghroBTg3YUYrO+wvzQsWhcoSzqbIt QG7cnjkdQdP/Od6NIFkuuR63+uTlJPy2QK9fC0ZOpQy8zb4VgrITSR5UU2mWsSVy jHJWjtaxSkDoqIRc5zw29FQV+5ihyfFrxFHDfNxZ5QTqjdMXxFccnMhF1ju5W3pL rC+gOgvTzTYMmbpc5ngwIPEGXO2H5yh/uvTuLXL6vPbXgTOb85a50g3zH9sXpm2g uMCosX7Gh/gTJ5pw8XR0ww98pdkVe0Ttv79Mqzw+/mhynMyOtBrF59dbuwaTwsew yFwpLHlVUfFNTBRsXlQeBiHdlt3K9yoPXnAfmLi+4yuaym0X8L+AzdTvCzpMvrwK i+vQK+ah08Je17SFeTfxCXx0vNtsDRf+sC2KjiDDt53LBGCZGktowcQaGPHo0gWP PnnKaKHjxcxhTe8FPtsVguLuBtfbaITmdGTXb8YJ/dtv3LDrQ3RCSFpp2YazawkW FUc90X5M3UtH8J3eutfPG/vsqyIhGdv2XbFkpCpZcO49n/xXYW1uiv3TpxnrJ2b8 1GK2fncbeLsEKfD4cFwM4XrEEXVMENDlxGTE0PM2A5gv+APRdHP+LwWQvyncCjVn lQmEtuc3my4= =mFKz -----END PGP SIGNATURE-----