公告ID(KYSA-202412-1095)
公告ID:KYSA-202412-1095
公告摘要:ruby安全漏洞
等級(jí):重要
發(fā)布日期:2024-12-10
詳細(xì)介紹
1.修復(fù)的漏洞
·CVE-2024-47220
描述:Webrick是The Ruby Programming Language開源的一個(gè) HTTP 服務(wù)器工具包。
Webrick 1.8.1版本存在安全漏洞,該漏洞源于通過提供Content-Length標(biāo)頭和Transfer-Encoding標(biāo)頭以允許HTTP請(qǐng)求走私。
·CVE-2024-49761
描述:REXML是Ruby開源的一個(gè)用于 Ruby 的 XML 工具包。
REXML 3.3.9之前版本存在安全漏洞,該漏洞源于解析含有大量數(shù)字的十六進(jìn)制數(shù)值字符引用的XML時(shí),容易受到正則表達(dá)式拒絕服務(wù)攻擊。
2.受影響的軟件包
·銀河麒麟高級(jí)服務(wù)器操作系統(tǒng) V10 SP3
·loongarch64架構(gòu):
rubygem-bigdecimal、rubygem-minitest、rubygem-net-telnet、rubygem-rdoc、rubygem-openssl、ruby-irb、rubygems、rubygem-power_assert、rubygem-xmlrpc、rubygem-test-unit、ruby-help、ruby、rubygem-psych、rubygem-io-console、rubygem-did_you_mean、rubygem-json、rubygem-rake、ruby-devel、rubygems-devel
·銀河麒麟高級(jí)服務(wù)器操作系統(tǒng) V10 SP3 2403
·loongarch64架構(gòu):
rubygem-bigdecimal、rubygem-minitest、rubygem-net-telnet、rubygem-rdoc、rubygem-openssl、ruby-irb、rubygem-power_assert、rubygems、rubygem-test-unit、rubygem-xmlrpc、ruby-help、ruby、rubygem-psych、rubygem-io-console、rubygem-did_you_mean、rubygem-json、rubygem-rake、ruby-devel、rubygems-devel
3.軟件包修復(fù)版本
·銀河麒麟高級(jí)服務(wù)器操作系統(tǒng) V10 SP3 (loongarch64)
rubygem-io-console-0.4.6-131.p01.a.ky10或以上版本
rubygem-minitest-5.10.3-131.p01.a.ky10或以上版本
rubygem-openssl-2.1.2-131.p01.a.ky10或以上版本
rubygems-devel-2.7.6-131.p01.a.ky10或以上版本
rubygem-bigdecimal-1.3.4-131.p01.a.ky10或以上版本
rubygem-json-2.1.0-131.p01.a.ky10或以上版本
rubygem-did_you_mean-1.2.0-131.p01.a.ky10或以上版本
rubygem-rake-12.3.0-131.p01.a.ky10或以上版本
ruby-2.5.8-131.p01.a.ky10或以上版本
rubygem-xmlrpc-0.3.0-131.p01.a.ky10或以上版本
rubygem-test-unit-3.2.7-131.p01.a.ky10或以上版本
ruby-devel-2.5.8-131.p01.a.ky10或以上版本
ruby-irb-2.5.8-131.p01.a.ky10或以上版本
rubygem-rdoc-6.0.1.1-131.p01.a.ky10或以上版本
ruby-help-2.5.8-131.p01.a.ky10或以上版本
rubygem-psych-3.0.2-131.p01.a.ky10或以上版本
rubygems-2.7.6-131.p01.a.ky10或以上版本
rubygem-power_assert-1.1.1-131.p01.a.ky10或以上版本
rubygem-net-telnet-0.1.1-131.p01.a.ky10或以上版本
·銀河麒麟高級(jí)服務(wù)器操作系統(tǒng) V10 SP3 2403 (loongarch64)
rubygem-io-console-0.4.6-131.p01.a.ky10或以上版本
rubygem-minitest-5.10.3-131.p01.a.ky10或以上版本
rubygem-openssl-2.1.2-131.p01.a.ky10或以上版本
rubygem-bigdecimal-1.3.4-131.p01.a.ky10或以上版本
rubygems-devel-2.7.6-131.p01.a.ky10或以上版本
rubygem-json-2.1.0-131.p01.a.ky10或以上版本
rubygem-did_you_mean-1.2.0-131.p01.a.ky10或以上版本
rubygem-rake-12.3.0-131.p01.a.ky10或以上版本
ruby-2.5.8-131.p01.a.ky10或以上版本
rubygem-test-unit-3.2.7-131.p01.a.ky10或以上版本
rubygem-rdoc-6.0.1.1-131.p01.a.ky10或以上版本
ruby-devel-2.5.8-131.p01.a.ky10或以上版本
ruby-irb-2.5.8-131.p01.a.ky10或以上版本
rubygem-xmlrpc-0.3.0-131.p01.a.ky10或以上版本
ruby-help-2.5.8-131.p01.a.ky10或以上版本
rubygem-psych-3.0.2-131.p01.a.ky10或以上版本
rubygems-2.7.6-131.p01.a.ky10或以上版本
rubygem-power_assert-1.1.1-131.p01.a.ky10或以上版本
rubygem-net-telnet-0.1.1-131.p01.a.ky10或以上版本
4.修復(fù)方法
方法一:配置源進(jìn)行升級(jí)安裝
1.打開軟件包源配置文件,根據(jù)倉(cāng)庫(kù)地址進(jìn)行修改。
倉(cāng)庫(kù)源地址:
銀河麒麟高級(jí)服務(wù)器操作系統(tǒng) V10 SP3
loongarch64:https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/
銀河麒麟高級(jí)服務(wù)器操作系統(tǒng) V10 SP3 2403
loongarch64:https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/
2.配置完成后執(zhí)行更新命令進(jìn)行升級(jí),命令如下:
yum update Packagename
方法二:下載安裝包進(jìn)行升級(jí)安裝
通過軟件包地址下載軟件包,使用軟件包升級(jí)命令根據(jù)受影響的軟件包
列表進(jìn)行升級(jí)安裝, 命令如下:
yum install Packagename
3.升級(jí)完成后是否需要重啟服務(wù)或操作系統(tǒng):
CVE-2024-47220:無需重啟操作系統(tǒng)與服務(wù)即可使漏洞修復(fù)生效。
CVE-2024-49761:無需重啟操作系統(tǒng)與服務(wù)即可使漏洞修復(fù)生效。
5.軟件包下載地址
·銀河麒麟高級(jí)服務(wù)器操作系統(tǒng) V10 SP3
ruby(loongarch64)軟件包下載地址:
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygems-devel-2.7.6-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/ruby-2.5.8-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/ruby-help-2.5.8-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-json-2.1.0-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/ruby-devel-2.5.8-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-minitest-5.10.3-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygems-2.7.6-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-xmlrpc-0.3.0-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-net-telnet-0.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-test-unit-3.2.7-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-io-console-0.4.6-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-bigdecimal-1.3.4-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/ruby-irb-2.5.8-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-rdoc-6.0.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-rake-12.3.0-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-psych-3.0.2-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-power_assert-1.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-openssl-2.1.2-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3/os/adv/lic/updates/loongarch64/Packages/rubygem-did_you_mean-1.2.0-131.p01.a.ky10.noarch.rpm
·銀河麒麟高級(jí)服務(wù)器操作系統(tǒng) V10 SP3 2403
ruby(loongarch64)軟件包下載地址:
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/ruby-help-2.5.8-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-io-console-0.4.6-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-bigdecimal-1.3.4-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-rake-12.3.0-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-bigdecimal-1.3.4-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/ruby-devel-2.5.8-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-psych-3.0.2-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/ruby-irb-2.5.8-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygems-devel-2.7.6-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-json-2.1.0-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-did_you_mean-1.2.0-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/ruby-irb-2.5.8-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/ruby-2.5.8-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-minitest-5.10.3-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-power_assert-1.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-openssl-2.1.2-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-net-telnet-0.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-test-unit-3.2.7-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-rdoc-6.0.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-did_you_mean-1.2.0-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-xmlrpc-0.3.0-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygems-2.7.6-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygems-2.7.6-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-io-console-0.4.6-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-json-2.1.0-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-minitest-5.10.3-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygems-devel-2.7.6-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/ruby-2.5.8-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-net-telnet-0.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-openssl-2.1.2-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-power_assert-1.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-xmlrpc-0.3.0-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/ruby-help-2.5.8-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-test-unit-3.2.7-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-rake-12.3.0-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-rdoc-6.0.1.1-131.p01.a.ky10.noarch.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/rubygem-psych-3.0.2-131.p01.a.ky10.loongarch64.rpm
https://update.cs2c.com.cn/NS/V10/V10SP3-2403/os/adv/lic/updates/loongarch64/Packages/ruby-devel-2.5.8-131.p01.a.ky10.loongarch64.rpm
注:其他相關(guān)依賴包請(qǐng)到相同目錄下載
6.修復(fù)驗(yàn)證
使用軟件包查詢命令,查看相關(guān)軟件包版本是否與修復(fù)版本一致,如果版本一致,則說明修復(fù)成功。
sudo rpm -qa | grep Packagename