Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

SUSE Linux: 2025:01586-1 important: rubygem-rack session management flaw

suse
Calendar Grey May 19, 2025
Dist Suse Esm H88
A patch has been issued for rubygem-rack addressing significant vulnerabilities and enhancing protection across multiple SUSE releases.
* bsc#1242894 * bsc#1242899 Cross-References: * CVE-2025-32441

Summary

## This update for rubygem-rack fixes the following issues: * CVE-2025-46727: possible memory exhaustion due to unbounded parameter parsing in Rack::QueryParser (bsc#1242894). * CVE-2025-32441: deleted sessions can be restored and occupied by unauthenticated users when the Rack::Session::Pool middleware is being used (bsc#1242899). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1586=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2025-1586=1 * SUSE Linux Enterprise High Availability Extension 15 SP4

Topics%20covered

Topics Covered

security advisory session management suse memory exhaustion attack vector rubygem

References

* bsc#1242894

* bsc#1242899

Cross-

* CVE-2025-32441

* CVE-2025-46727

CVSS scores:

* CVE-2025-32441 ( SUSE ): 2.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

* CVE-2025-32441 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

* CVE-2025-32441 ( NVD ): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

* CVE-2025-46727 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2025-46727 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2025-46727 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* openSUSE Leap 15.6

* SUSE Linux Enterprise High Availability Extension 15 SP3

* SUSE Linux Enterprise High Availability Extension 15 SP4

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:01586-1
Release Date: 2025-05-19T17:23:48Z
Rating: important

Topics%20covered

Topics Covered

security advisory session management suse memory exhaustion attack vector rubygem

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here