<?xml version="1.0" encoding="utf-8"?>
  <?xml-stylesheet type="text/xsl" href="sa-render.xsl"?>
  <update from="huaweicloud.com" type="security" status="stable" version="1">
    <id>HCE2-SA-2023-0221</id>
    <title>An update for ruby is now available for HCE 2.0</title>
    <severity>Important</severity>
    <release>HCE 2.0</release>
    <issued date="2023-06-28 16:11:19"/>
    <updated date="2023-06-28 16:11:19"/>
    <references>
      <reference href="https://nvd.nist.gov/vuln/detail/CVE-2023-28756" id="CVE-2023-28756" title="CVE-2023-28756 Base Score: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" type="cve"/>
      <reference href="https://nvd.nist.gov/vuln/detail/CVE-2023-28755" id="CVE-2023-28755" title="CVE-2023-28755 Base Score: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" type="cve"/>
    </references>
    <description>Security Fix(es):

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)
</description>
    <pkglist>
      <collection short="HCE 2.0" package="ruby">
        <name>HCE 2.0</name>
        <package arch="noarch" name="rubygems" version="3.2.32" release="122.r8.hce2">
          <filename>rubygems-3.2.32-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygems-devel" version="3.2.32" release="122.r8.hce2">
          <filename>rubygems-devel-3.2.32-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-bigdecimal" version="3.0.0" release="122.r8.hce2">
          <filename>rubygem-bigdecimal-3.0.0-122.r8.hce2.aarch64.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-did_you_mean" version="1.5.0" release="122.r8.hce2">
          <filename>rubygem-did_you_mean-1.5.0-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-io-console" version="0.5.7" release="122.r8.hce2">
          <filename>rubygem-io-console-0.5.7-122.r8.hce2.aarch64.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-json" version="2.5.1" release="122.r8.hce2">
          <filename>rubygem-json-2.5.1-122.r8.hce2.aarch64.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-minitest" version="5.14.2" release="122.r8.hce2">
          <filename>rubygem-minitest-5.14.2-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-openssl" version="2.2.1" release="122.r8.hce2">
          <filename>rubygem-openssl-2.2.1-122.r8.hce2.aarch64.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-power_assert" version="1.2.0" release="122.r8.hce2">
          <filename>rubygem-power_assert-1.2.0-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="aarch64" name="rubygem-psych" version="3.3.2" release="122.r8.hce2">
          <filename>rubygem-psych-3.3.2-122.r8.hce2.aarch64.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rake" version="13.0.3" release="122.r8.hce2">
          <filename>rubygem-rake-13.0.3-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rbs" version="1.4.0" release="122.r8.hce2">
          <filename>rubygem-rbs-1.4.0-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rdoc" version="6.3.3" release="122.r8.hce2">
          <filename>rubygem-rdoc-6.3.3-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rexml" version="3.2.5" release="122.r8.hce2">
          <filename>rubygem-rexml-3.2.5-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-rss" version="0.2.9" release="122.r8.hce2">
          <filename>rubygem-rss-0.2.9-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-test-unit" version="3.3.7" release="122.r8.hce2">
          <filename>rubygem-test-unit-3.3.7-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="rubygem-typeprof" version="0.15.2" release="122.r8.hce2">
          <filename>rubygem-typeprof-0.15.2-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="aarch64" name="ruby" version="3.0.3" release="122.r8.hce2">
          <filename>ruby-3.0.3-122.r8.hce2.aarch64.rpm</filename>
        </package>
        <package arch="aarch64" name="ruby-devel" version="3.0.3" release="122.r8.hce2">
          <filename>ruby-devel-3.0.3-122.r8.hce2.aarch64.rpm</filename>
        </package>
        <package arch="noarch" name="ruby-help" version="3.0.3" release="122.r8.hce2">
          <filename>ruby-help-3.0.3-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="noarch" name="ruby-irb" version="3.0.3" release="122.r8.hce2">
          <filename>ruby-irb-3.0.3-122.r8.hce2.noarch.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-bigdecimal" version="3.0.0" release="122.r8.hce2">
          <filename>rubygem-bigdecimal-3.0.0-122.r8.hce2.x86_64.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-io-console" version="0.5.7" release="122.r8.hce2">
          <filename>rubygem-io-console-0.5.7-122.r8.hce2.x86_64.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-json" version="2.5.1" release="122.r8.hce2">
          <filename>rubygem-json-2.5.1-122.r8.hce2.x86_64.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-openssl" version="2.2.1" release="122.r8.hce2">
          <filename>rubygem-openssl-2.2.1-122.r8.hce2.x86_64.rpm</filename>
        </package>
        <package arch="x86_64" name="rubygem-psych" version="3.3.2" release="122.r8.hce2">
          <filename>rubygem-psych-3.3.2-122.r8.hce2.x86_64.rpm</filename>
        </package>
        <package arch="x86_64" name="ruby" version="3.0.3" release="122.r8.hce2">
          <filename>ruby-3.0.3-122.r8.hce2.x86_64.rpm</filename>
        </package>
        <package arch="x86_64" name="ruby-devel" version="3.0.3" release="122.r8.hce2">
          <filename>ruby-devel-3.0.3-122.r8.hce2.x86_64.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
