Nchafatsa Ruby 2.6.5, 2.5.7 le 2.4.8 ka bofokoli bo tsitsitseng

Litokollo tse lokisoang tsa puo ea lenaneo la Ruby li hlahisitsoe 2.6.5, 2.5.7 и 2.4.8, e ileng ea lokisa mefokolo e mene. Kotsi e kotsi ka ho fetisisa (CVE-2019-16255) laeboraring e tloaelehileng Shell (lib/shell.rb), eo e lumella etsa phetoho ya khoutu. Haeba data e amohetsoeng ho tsoa ho mosebelisi e sebetsoa khang ea pele ea Shell#[] kapa Shell#test mekhoa e sebelisoang ho lekola boteng ba faele, mohlaseli a ka etsa hore ho bitsoe mokhoa oa Ruby o sa reroang.

Mathata a mang:

• CVE-2019-16254 - ho pepeseha ho seva sa http se hahiloeng WEBrick Tlhaselo ea ho arohana ha karabo ea HTTP (haeba lenaneo le kenya lintlha tse sa netefatsoang hloohong ea karabo ea HTTP, joale hlooho e ka aroloa ka ho kenya mohala o mocha);
• CVE-2019-15845 ho nkela sebaka sa null character (\0) ho tse hlahlobiloeng ka mekhoa ea “File.fnmatch” le “File.fnmatch?”. litsela tsa faele li ka sebelisoa ho hlahisa cheke ka bohata;
• CVE-2019-16201 - ho haneloa ha ts'ebeletso mojuleng oa netefatso oa Diges bakeng sa WEBrick.

Source: opennet.ru