Bug 1833040

Summary:	CVE-2020-10933: Heap exposure vulnerability in the socket library
Product:	[Fedora] Fedora	Reporter:	Randy Barlow <randy>
Component:	ruby	Assignee:	Pavel Valena <pvalena>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	31	CC:	mo, mtasaka, pvalena, ruby-packagers-sig, s, strzibny, vanmeeuwen+fedora, vondruch
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-11 08:01:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Randy Barlow 2020-05-07 17:15:48 UTC

See https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/

I see that Fedora 32 has 2.7.1, which has the fix. However, Fedora 30 and 31 both have 2.6.5, so they are both vulnerable.

Comment 1 Pavel Valena 2020-05-07 23:20:23 UTC

I'm working on those rebases.

Comment 2 Vít Ondruch 2020-05-11 08:01:01 UTC

Let's close this in favor of the official security tracking bug.

*** This bug has been marked as a duplicate of bug 1833293 ***