{"id":38594,"date":"2019-10-31T22:24:44","date_gmt":"2019-10-31T19:24:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/obnovlenie-ruby-2-6-5-2-5-7-i-2-4-8-s-ustraneniem-uyazvimostej\/"},"modified":"2019-10-31T22:24:44","modified_gmt":"2019-10-31T19:24:44","slug":"obnovlenie-ruby-2-6-5-2-5-7-i-2-4-8-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-ruby-2-6-5-2-5-7-i-2-4-8-s-ustraneniem-uyazvimostej","title":{"rendered":"Mise \u00e0 jour de Ruby 2.6.5, 2.5.7 et 2.4.8 avec correction de vuln\u00e9rabilit\u00e9s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Des versions de correction du langage de programmation Ruby ont \u00e9t\u00e9 publi\u00e9es  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ruby-lang.org\/en\/news\/2019\/10\/01\/ruby-2-6-5-released\/\">2.6.5<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ruby-lang.org\/en\/news\/2019\/10\/01\/ruby-2-5-7-released\/\">2.5.7<\/a><\/noindex> et <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ruby-lang.org\/en\/news\/2019\/10\/01\/ruby-2-4-8-released\/\">2.4.8<\/a><\/noindex>, dans lesquelles quatre vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es. La vuln\u00e9rabilit\u00e9 la plus critique (CVE-2019-16255) se trouve dans la biblioth\u00e8que standard <noindex><a rel=\"nofollow\" href=\"https:\/\/ruby-doc.org\/stdlib-2.6.3\/libdoc\/shell\/rdoc\/Shell.html\">Shell<\/a><\/noindex> (lib\/shell.rb), qui <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ruby-lang.org\/en\/news\/2019\/10\/01\/code-injection-shell-test-cve-2019-16255\/\">d'installer<\/a><\/noindex> permet d'effectuer une injection de code. En cas de traitement de donn\u00e9es provenant de l'utilisateur dans le premier argument des m\u00e9thodes Shell#[] ou Shell#test, utilis\u00e9es pour v\u00e9rifier l'existence d'un fichier, un attaquant pourrait provoquer l'appel d'une m\u00e9thode Ruby arbitraire.<\/p>\n<p>Autres probl\u00e8mes :<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ruby-lang.org\/en\/news\/2019\/10\/01\/http-response-splitting-in-webrick-cve-2019-16254\/\">CVE-2019-16254<\/a><\/noindex> \u2014 vuln\u00e9rabilit\u00e9 du serveur HTTP int\u00e9gr\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ruby\/webrick\">WEBrick<\/a><\/noindex> \u00e0 une attaque par injection de r\u00e9ponse HTTP (si le programme ins\u00e8re des donn\u00e9es non v\u00e9rifi\u00e9es dans l'en-t\u00eate de r\u00e9ponse HTTP, un attaquant peut diviser l'en-t\u00eate en ins\u00e9rant un caract\u00e8re de saut de ligne);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ruby-lang.org\/en\/news\/2019\/10\/01\/nul-injection-file-fnmatch-cve-2019-15845\/\">CVE-2019-15845<\/a><\/noindex> L'insertion d'un caract\u00e8re nul (\\0) dans les chemins de fichiers v\u00e9rifi\u00e9s par les m\u00e9thodes \u00ab File.fnmatch \u00bb et \u00ab File.fnmatch? \u00bb peut \u00eatre utilis\u00e9e pour provoquer des faux positifs lors de la v\u00e9rification ;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ruby-lang.org\/en\/news\/2019\/10\/01\/webrick-regexp-digestauth-dos-cve-2019-16201\/\">CVE-2019-16201<\/a><\/noindex> \u2014 d\u00e9ni de service dans le module d'authentification Diges pour WEBrick.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51598\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Ruby 2.6.5, 2.5.7 \u0438 2.4.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-16255) \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Shell (lib\/shell.rb), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043a\u043e\u0434\u0430. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0435 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 Shell#[] \u0438\u043b\u0438 Shell#test, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0444\u0430\u0439\u043b\u0430, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e Ruby-\u043c\u0435\u0442\u043e\u0434\u0430. \u0414\u0440\u0443\u0433\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38594","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Ruby 2.6.5,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-ruby-2-6-5-2-5-7-i-2-4-8-s-ustraneniem-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Ruby 2.6.5, 2.5.7 \u0438 2.4.8 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Ruby 2.6.5,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-ruby-2-6-5-2-5-7-i-2-4-8-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:24:44+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:24:44+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mise \u00e0 jour de Ruby 2.6.5, 2.5.7 et 2.4.8 corrigeant les vuln\u00e9rabilit\u00e9s | ProHoster","description":"Des versions de correction du langage de programmation Ruby 2.6.5 ont \u00e9t\u00e9 publi\u00e9es,","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-ruby-2-6-5-2-5-7-i-2-4-8-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Ruby 2.6.5, 2.5.7 \u0438 2.4.8 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Ruby 2.6.5,","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-ruby-2-6-5-2-5-7-i-2-4-8-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:44+00:00","article:modified_time":"2019-10-31T19:24:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38594","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:40:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:06:25","updated":"2026-01-23 22:40:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/38594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=38594"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/38594\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=38594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=38594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=38594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}