openSUSE Security Update: Security update for ruby-bundled-gems-rpmhelper, ruby2.5
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2019:1771-1
Rating:             important
References:         #1082007 #1082008 #1082009 #1082010 #1082011 
                    #1082014 #1082058 #1087433 #1087434 #1087436 
                    #1087437 #1087440 #1087441 #1112530 #1112532 
                    #1130028 #1130611 #1130617 #1130620 #1130622 
                    #1130623 #1130627 #1133790 
Cross-References:   CVE-2017-17742 CVE-2018-1000073 CVE-2018-1000074
                    CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077
                    CVE-2018-1000078 CVE-2018-1000079 CVE-2018-16395
                    CVE-2018-16396 CVE-2018-6914 CVE-2018-8777
                    CVE-2018-8778 CVE-2018-8779 CVE-2018-8780
                    CVE-2019-8320 CVE-2019-8321 CVE-2019-8322
                    CVE-2019-8323 CVE-2019-8324 CVE-2019-8325
                   
Affected Products:
                    openSUSE Leap 15.1
                    openSUSE Leap 15.0
______________________________________________________________________________

   An update that solves 21 vulnerabilities and has two fixes
   is now available.

Description:

   This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the
   following issues:

   Changes in ruby2.5:

   Update to 2.5.5 and 2.5.4:

   https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/
   https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/

   Security issues fixed:

   - CVE-2019-8320: Delete directory using symlink when decompressing tar
     (bsc#1130627)
   - CVE-2019-8321: Escape sequence injection vulnerability in verbose
     (bsc#1130623)
   - CVE-2019-8322: Escape sequence injection vulnerability in gem
     owner  (bsc#1130622)
   - CVE-2019-8323: Escape sequence injection vulnerability in API response
     handling  (bsc#1130620)
   - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code
     execution  (bsc#1130617)
   - CVE-2019-8325: Escape sequence injection vulnerability in errors     (bsc#1130611)


   Ruby 2.5 was updated to 2.5.3:

   This release includes some bug fixes and some security fixes.

   Security issues fixed:

   - CVE-2018-16396: Tainted flags are not propagated in Array#pack and
     String#unpack with some directives (bsc#1112532)
   - CVE-2018-16395: OpenSSL::X509::Name equality check does not work
     correctly (bsc#1112530)

   Ruby 2.5 was updated to 2.5.1:

   This release includes some bug fixes and some security fixes.

   Security issues fixed:

   - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434)
   - CVE-2018-6914: Unintentional file and directory creation with directory
     traversal in tempfile and tmpdir (bsc#1087441)
   - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436)
   - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433)
   - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
     UNIXServer and UNIXSocket (bsc#1087440)
   - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in
     Dir (bsc#1087437)

   - Multiple vulnerabilities in RubyGems were fixed:

     - CVE-2018-1000079: Fixed path traversal issue during gem installation
       allows to write to arbitrary filesystem locations (bsc#1082058)
     - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative
       size in tar header causes Denial of Service (bsc#1082014)
     - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when
       displayed via gem server (bsc#1082011)
     - CVE-2018-1000077: Fixed that missing URL validation on spec home
       attribute allows malicious gem to set an invalid homepage URL
       (bsc#1082010)
     - CVE-2018-1000076: Fixed improper verification of signatures in tarball
       allows to install mis-signed gem (bsc#1082009)
     - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in
       gem owner allowing arbitrary code execution on specially crafted YAML
       (bsc#1082008)
     - CVE-2018-1000073: Fixed path traversal when writing to a symlinked
       basedir outside of the root (bsc#1082007)

   Other changes:

   - Fixed Net::POPMail methods modify frozen literal when using default arg
   - ruby: change over of the Japanese Era to the new emperor May 1st 2019
     (bsc#1133790)
   - build with PIE support (bsc#1130028)


   Changes in ruby-bundled-gems-rpmhelper:

   - Add a new helper for bundled ruby gems.

   This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.1:

      zypper in -t patch openSUSE-2019-1771=1

   - openSUSE Leap 15.0:

      zypper in -t patch openSUSE-2019-1771=1



Package List:

   - openSUSE Leap 15.1 (noarch):

      ruby-bundled-gems-rpmhelper-0.0.2-lp151.2.1
      ruby2.5-doc-ri-2.5.5-lp151.4.3.1

   - openSUSE Leap 15.1 (x86_64):

      libruby2_5-2_5-2.5.5-lp151.4.3.1
      libruby2_5-2_5-debuginfo-2.5.5-lp151.4.3.1
      ruby2.5-2.5.5-lp151.4.3.1
      ruby2.5-debuginfo-2.5.5-lp151.4.3.1
      ruby2.5-debugsource-2.5.5-lp151.4.3.1
      ruby2.5-devel-2.5.5-lp151.4.3.1
      ruby2.5-devel-extra-2.5.5-lp151.4.3.1
      ruby2.5-doc-2.5.5-lp151.4.3.1
      ruby2.5-stdlib-2.5.5-lp151.4.3.1
      ruby2.5-stdlib-debuginfo-2.5.5-lp151.4.3.1

   - openSUSE Leap 15.0 (noarch):

      ruby-bundled-gems-rpmhelper-0.0.2-lp150.2.1
      ruby2.5-doc-ri-2.5.5-lp150.3.3.1

   - openSUSE Leap 15.0 (x86_64):

      libruby2_5-2_5-2.5.5-lp150.3.3.1
      libruby2_5-2_5-debuginfo-2.5.5-lp150.3.3.1
      ruby2.5-2.5.5-lp150.3.3.1
      ruby2.5-debuginfo-2.5.5-lp150.3.3.1
      ruby2.5-debugsource-2.5.5-lp150.3.3.1
      ruby2.5-devel-2.5.5-lp150.3.3.1
      ruby2.5-devel-extra-2.5.5-lp150.3.3.1
      ruby2.5-doc-2.5.5-lp150.3.3.1
      ruby2.5-stdlib-2.5.5-lp150.3.3.1
      ruby2.5-stdlib-debuginfo-2.5.5-lp150.3.3.1


References:

   https://www.suse.com/security/cve/CVE-2017-17742.html
   https://www.suse.com/security/cve/CVE-2018-1000073.html
   https://www.suse.com/security/cve/CVE-2018-1000074.html
   https://www.suse.com/security/cve/CVE-2018-1000075.html
   https://www.suse.com/security/cve/CVE-2018-1000076.html
   https://www.suse.com/security/cve/CVE-2018-1000077.html
   https://www.suse.com/security/cve/CVE-2018-1000078.html
   https://www.suse.com/security/cve/CVE-2018-1000079.html
   https://www.suse.com/security/cve/CVE-2018-16395.html
   https://www.suse.com/security/cve/CVE-2018-16396.html
   https://www.suse.com/security/cve/CVE-2018-6914.html
   https://www.suse.com/security/cve/CVE-2018-8777.html
   https://www.suse.com/security/cve/CVE-2018-8778.html
   https://www.suse.com/security/cve/CVE-2018-8779.html
   https://www.suse.com/security/cve/CVE-2018-8780.html
   https://www.suse.com/security/cve/CVE-2019-8320.html
   https://www.suse.com/security/cve/CVE-2019-8321.html
   https://www.suse.com/security/cve/CVE-2019-8322.html
   https://www.suse.com/security/cve/CVE-2019-8323.html
   https://www.suse.com/security/cve/CVE-2019-8324.html
   https://www.suse.com/security/cve/CVE-2019-8325.html
   https://bugzilla.suse.com/1082007
   https://bugzilla.suse.com/1082008
   https://bugzilla.suse.com/1082009
   https://bugzilla.suse.com/1082010
   https://bugzilla.suse.com/1082011
   https://bugzilla.suse.com/1082014
   https://bugzilla.suse.com/1082058
   https://bugzilla.suse.com/1087433
   https://bugzilla.suse.com/1087434
   https://bugzilla.suse.com/1087436
   https://bugzilla.suse.com/1087437
   https://bugzilla.suse.com/1087440
   https://bugzilla.suse.com/1087441
   https://bugzilla.suse.com/1112530
   https://bugzilla.suse.com/1112532
   https://bugzilla.suse.com/1130028
   https://bugzilla.suse.com/1130611
   https://bugzilla.suse.com/1130617
   https://bugzilla.suse.com/1130620
   https://bugzilla.suse.com/1130622
   https://bugzilla.suse.com/1130623
   https://bugzilla.suse.com/1130627
   https://bugzilla.suse.com/1133790

--

openSUSE: 2019:1771-1: important: ruby-bundled-gems-rpmhelper, ruby2.5

July 21, 2019
An update that solves 21 vulnerabilities and has two fixes is now available.

Description

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues: Changes in ruby2.5: Update to 2.5.5 and 2.5.4: https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed: - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed: - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: - Add a new helper for bundled ruby gems. This update was imported from the SUSE:SLE-15:Update update project.

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1771=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1771=1


Package List

- openSUSE Leap 15.1 (noarch): ruby-bundled-gems-rpmhelper-0.0.2-lp151.2.1 ruby2.5-doc-ri-2.5.5-lp151.4.3.1 - openSUSE Leap 15.1 (x86_64): libruby2_5-2_5-2.5.5-lp151.4.3.1 libruby2_5-2_5-debuginfo-2.5.5-lp151.4.3.1 ruby2.5-2.5.5-lp151.4.3.1 ruby2.5-debuginfo-2.5.5-lp151.4.3.1 ruby2.5-debugsource-2.5.5-lp151.4.3.1 ruby2.5-devel-2.5.5-lp151.4.3.1 ruby2.5-devel-extra-2.5.5-lp151.4.3.1 ruby2.5-doc-2.5.5-lp151.4.3.1 ruby2.5-stdlib-2.5.5-lp151.4.3.1 ruby2.5-stdlib-debuginfo-2.5.5-lp151.4.3.1 - openSUSE Leap 15.0 (noarch): ruby-bundled-gems-rpmhelper-0.0.2-lp150.2.1 ruby2.5-doc-ri-2.5.5-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libruby2_5-2_5-2.5.5-lp150.3.3.1 libruby2_5-2_5-debuginfo-2.5.5-lp150.3.3.1 ruby2.5-2.5.5-lp150.3.3.1 ruby2.5-debuginfo-2.5.5-lp150.3.3.1 ruby2.5-debugsource-2.5.5-lp150.3.3.1 ruby2.5-devel-2.5.5-lp150.3.3.1 ruby2.5-devel-extra-2.5.5-lp150.3.3.1 ruby2.5-doc-2.5.5-lp150.3.3.1 ruby2.5-stdlib-2.5.5-lp150.3.3.1 ruby2.5-stdlib-debuginfo-2.5.5-lp150.3.3.1


References

https://www.suse.com/security/cve/CVE-2017-17742.html https://www.suse.com/security/cve/CVE-2018-1000073.html https://www.suse.com/security/cve/CVE-2018-1000074.html https://www.suse.com/security/cve/CVE-2018-1000075.html https://www.suse.com/security/cve/CVE-2018-1000076.html https://www.suse.com/security/cve/CVE-2018-1000077.html https://www.suse.com/security/cve/CVE-2018-1000078.html https://www.suse.com/security/cve/CVE-2018-1000079.html https://www.suse.com/security/cve/CVE-2018-16395.html https://www.suse.com/security/cve/CVE-2018-16396.html https://www.suse.com/security/cve/CVE-2018-6914.html https://www.suse.com/security/cve/CVE-2018-8777.html https://www.suse.com/security/cve/CVE-2018-8778.html https://www.suse.com/security/cve/CVE-2018-8779.html https://www.suse.com/security/cve/CVE-2018-8780.html https://www.suse.com/security/cve/CVE-2019-8320.html https://www.suse.com/security/cve/CVE-2019-8321.html https://www.suse.com/security/cve/CVE-2019-8322.html https://www.suse.com/security/cve/CVE-2019-8323.html https://www.suse.com/security/cve/CVE-2019-8324.html https://www.suse.com/security/cve/CVE-2019-8325.html https://bugzilla.suse.com/1082007 https://bugzilla.suse.com/1082008 https://bugzilla.suse.com/1082009 https://bugzilla.suse.com/1082010 https://bugzilla.suse.com/1082011 https://bugzilla.suse.com/1082014 https://bugzilla.suse.com/1082058 https://bugzilla.suse.com/1087433 https://bugzilla.suse.com/1087434 https://bugzilla.suse.com/1087436 https://bugzilla.suse.com/1087437 https://bugzilla.suse.com/1087440 https://bugzilla.suse.com/1087441 https://bugzilla.suse.com/1112530 https://bugzilla.suse.com/1112532 https://bugzilla.suse.com/1130028 https://bugzilla.suse.com/1130611 https://bugzilla.suse.com/1130617 https://bugzilla.suse.com/1130620 https://bugzilla.suse.com/1130622 https://bugzilla.suse.com/1130623 https://bugzilla.suse.com/1130627 https://bugzilla.suse.com/1133790--


Severity
Announcement ID: openSUSE-SU-2019:1771-1
Rating: important
Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 le.

Related News

24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved