Stay Secure with the Latest Linux Advisories

security advisorysecurity updatecritical

Debian: DLA-2390-1 Critical: Ruby-Json-Jwt String Element Handling

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. Therefore, there was a need to explicitly specify the number . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2390-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Utkarsh Gupta October 01, 2020 https://wiki.debian.org/LTS - ----------------------------------------------------------------------- Package : ruby-json-jwt Version : 1.6.2-1+deb9u2 CVE ID : CVE-2019-18848 Debian Bug : 944850 The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. Therefore, there was a need to explicitly specify the number of elements when splitting a JWE string. For Debian 9 stretch, this problem has been fixed in version 1.6.2-1+deb9u2. We recommend that you upgrade your ruby-json-jwt packages. For the detailed security status of ruby-json-jwt please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/ruby-json-jwt Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . The Ubuntu Security Notice USN-4523-1 highlights a significant vulnerability in python-requests stemming from inadequate SSL verification during request handling.. ruby-json-jwt, security update, string handling, Debian advisory. . Severity: Critical. LinuxSecurity.com Team

Oct 01, 2020 •Critical Debian LTS