Alpine: multiple ruby packages: security update to 3.3.13-r0

medium Tenable Cloud Security Plugin ID 477565

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0,
3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The
zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but
fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing
data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been
fixed in versions 3.0.1, 3.1.2 and 3.2.3. (CVE-2026-27820)

- An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before
19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before
19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary
code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
(CVE-2026-110264)

- ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org)
introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution
when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public
methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`,
`ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a
Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code
execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch
the issue. (CVE-2026-41316)

- An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,
Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for
each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while
decoding a response. Each generated class was permanently registered both as a constant on Resource (or
SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained
reachable through that constant after the response was discarded. Type and class are each 16-bit values,
and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream
DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few
hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by
tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage
collection, because the constant keeps each class alive. Any code path that calls
Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and
thus this is reachable from a plain Ruby installation without any additional dependency. (CVE-2026-80212)

Solution

Update the ruby library and its related packages to version 3.3.13-r0 or later.

Plugin Details

Severity: Medium

ID: 477565

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/27/2026

Updated: 10/27/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.69

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-27820

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 2.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 4/16/2026

Reference Information

CVE: CVE-2026-110264, CVE-2026-27820, CVE-2026-41316, CVE-2026-80212, CVE-2026-80213, CVE-2026-89078, CVE-2026-93577, CVE-2026-97229

Detections

Analytics