Alerts This Week
Warning Icon 1 1,394
Alerts This Week
Warning Icon 1 1,394

SUSE: 2025:0736-1 Important: Fix for ruby2.5 HTTP Attack and ReDoS

suse
Calendar Grey February 27, 2025
Dist Suse Esm H88
A recent security update for ruby2.5 tackles critical vulnerabilities. Ensure that your SUSE systems are updated without delay.
* bsc#1230930 * bsc#1232440 Cross-References: * CVE-2024-47220

Summary

## This update for ruby2.5 fixes the following issues: * CVE-2024-47220: Fixed a HTTP request smuggling attack in WEBrick (bsc#1230930) * CVE-2024-49761: Fixed a ReDoS vulnerability in ruby rexml (bsc#1232440) Other fixes: * [ruby/uri] Fix quadratic backtracking on invalid relative URI * [ruby/time] Make RFC2822 regexp linear * [ruby/time] Fix quadratic backtracking on invalid time * merge some parts of CGI 0.1.1 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-736=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4

Topics%20covered

Topics Covered

security advisory update critical vulnerability SUSE important update HTTP attack ruby2.5 ReDoS

References

* bsc#1230930

* bsc#1232440

Cross-

* CVE-2024-47220

* CVE-2024-49761

CVSS scores:

* CVE-2024-47220 ( SUSE ): 8.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

* CVE-2024-47220 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

* CVE-2024-47220 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

* CVE-2024-49761 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2024-49761 ( NVD ): 6.6

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

* CVE-2024-49761 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* Basesystem Module 15-SP6

* openSUSE Leap 15.6

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:0736-1
Release Date: 2025-02-26T18:38:59Z
Rating: important

Topics%20covered

Topics Covered

security advisory update critical vulnerability SUSE important update HTTP attack ruby2.5 ReDoS

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here