Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisoryRed Hatsecurity fixRedHat: RHSA-2021:3020-01 Important: Ruby 2.7 Security Risk
An update for the ruby:2.7 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: ruby:2.7 security update Advisory ID: RHSA-2021:3020-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:3020 Issue date: 2021-08-05 CVE Names: CVE-2020-36327 CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 ==================================================================== 1. Summary: An update for the ruby:2.7 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327) * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799) * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810) * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4.Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1958999 - CVE-2020-36327 rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source 1980126 - CVE-2021-31810 ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host 1980128 - CVE-2021-32066 ruby: StartTLS stripping vulnerability in Net::IMAP 1980132 - CVE-2021-31799 rubygem-rdoc: Command injection vulnerability in RDoc 6. Package List: Red Hat Enterprise Linux AppStream (v.8): Source: ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.src.rpm rubygem-abrt-0.4.0-1.module+el8.3.0+7192+4e3a532a.src.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.src.rpm rubygem-mongo-2.11.3-1.module+el8.3.0+7192+4e3a532a.src.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.src.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.src.rpm aarch64: ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64.rpm ruby-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64.rpm ruby-debugsource-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64.rpm ruby-devel-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64.rpm ruby-libs-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64.rpm ruby-libs-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-bigdecimal-2.0.0-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-bigdecimal-debuginfo-2.0.0-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-io-console-0.5.6-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-io-console-debuginfo-0.5.6-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-json-2.3.0-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-json-debuginfo-2.3.0-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-openssl-2.1.2-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-openssl-debuginfo-2.1.2-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.aarch64.rpm rubygem-psych-3.1.0-137.module+el8.4.0+12025+f744ca41.aarch64.rpm rubygem-psych-debuginfo-3.1.0-137.module+el8.4.0+12025+f744ca41.aarch64.rpm noarch: ruby-default-gems-2.7.4-137.module+el8.4.0+12025+f744ca41.noarch.rpm ruby-doc-2.7.4-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-abrt-0.4.0-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-abrt-doc-0.4.0-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-bson-doc-4.8.1-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-bundler-2.2.24-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-irb-1.2.6-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-minitest-5.13.0-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-mongo-2.11.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-mongo-doc-2.11.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-mysql2-doc-0.5.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-net-telnet-0.2.0-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-pg-doc-1.2.3-1.module+el8.3.0+7192+4e3a532a.noarch.rpm rubygem-power_assert-1.1.7-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-rake-13.0.1-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-rdoc-6.2.1.1-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-test-unit-3.3.4-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygem-xmlrpc-0.3.0-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygems-3.1.6-137.module+el8.4.0+12025+f744ca41.noarch.rpm rubygems-devel-3.1.6-137.module+el8.4.0+12025+f744ca41.noarch.rpm ppc64le: ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm ruby-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm ruby-debugsource-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm ruby-devel-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm ruby-libs-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm ruby-libs-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-bigdecimal-2.0.0-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-bigdecimal-debuginfo-2.0.0-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-io-console-0.5.6-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-io-console-debuginfo-0.5.6-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-json-2.3.0-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-json-debuginfo-2.3.0-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-openssl-2.1.2-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-openssl-debuginfo-2.1.2-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.ppc64le.rpm rubygem-psych-3.1.0-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm rubygem-psych-debuginfo-3.1.0-137.module+el8.4.0+12025+f744ca41.ppc64le.rpm s390x: ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.s390x.rpm ruby-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.s390x.rpm ruby-debugsource-2.7.4-137.module+el8.4.0+12025+f744ca41.s390x.rpm ruby-devel-2.7.4-137.module+el8.4.0+12025+f744ca41.s390x.rpm ruby-libs-2.7.4-137.module+el8.4.0+12025+f744ca41.s390x.rpm ruby-libs-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-bigdecimal-2.0.0-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-bigdecimal-debuginfo-2.0.0-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-io-console-0.5.6-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-io-console-debuginfo-0.5.6-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-json-2.3.0-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-json-debuginfo-2.3.0-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-openssl-2.1.2-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-openssl-debuginfo-2.1.2-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.s390x.rpm rubygem-psych-3.1.0-137.module+el8.4.0+12025+f744ca41.s390x.rpm rubygem-psych-debuginfo-3.1.0-137.module+el8.4.0+12025+f744ca41.s390x.rpm x86_64: ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.i686.rpm ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.x86_64.rpm ruby-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.i686.rpm ruby-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.x86_64.rpm ruby-debugsource-2.7.4-137.module+el8.4.0+12025+f744ca41.i686.rpm ruby-debugsource-2.7.4-137.module+el8.4.0+12025+f744ca41.x86_64.rpm ruby-devel-2.7.4-137.module+el8.4.0+12025+f744ca41.i686.rpm ruby-devel-2.7.4-137.module+el8.4.0+12025+f744ca41.x86_64.rpm ruby-libs-2.7.4-137.module+el8.4.0+12025+f744ca41.i686.rpm ruby-libs-2.7.4-137.module+el8.4.0+12025+f744ca41.x86_64.rpm ruby-libs-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.i686.rpm ruby-libs-debuginfo-2.7.4-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-bigdecimal-2.0.0-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-bigdecimal-2.0.0-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-bigdecimal-debuginfo-2.0.0-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-bigdecimal-debuginfo-2.0.0-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-bson-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-bson-debuginfo-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-bson-debugsource-4.8.1-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-io-console-0.5.6-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-io-console-0.5.6-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-io-console-debuginfo-0.5.6-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-io-console-debuginfo-0.5.6-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-json-2.3.0-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-json-2.3.0-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-json-debuginfo-2.3.0-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-json-debuginfo-2.3.0-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-mysql2-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-mysql2-debuginfo-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-mysql2-debugsource-0.5.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-openssl-2.1.2-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-openssl-2.1.2-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-openssl-debuginfo-2.1.2-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-openssl-debuginfo-2.1.2-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-pg-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-pg-debuginfo-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-pg-debugsource-1.2.3-1.module+el8.3.0+7192+4e3a532a.x86_64.rpm rubygem-psych-3.1.0-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-psych-3.1.0-137.module+el8.4.0+12025+f744ca41.x86_64.rpm rubygem-psych-debuginfo-3.1.0-137.module+el8.4.0+12025+f744ca41.i686.rpm rubygem-psych-debuginfo-3.1.0-137.module+el8.4.0+12025+f744ca41.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-36327 https://access.redhat.com/security/cve/CVE-2021-31799 https://access.redhat.com/security/cve/CVE-2021-31810 https://access.redhat.com/security/cve/CVE-2021-32066 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . Morecontact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYQv7x9zjgjWX9erEAQjEBRAAjA5YQTWjDDJ3vDe7A0+T3FE7l5m92DSt iCuyOo0y8PcMDNmHVLIHpQpzQRp/076dl9V4YeGerO68Bwlu+CBPFhsx7xgquzYm StzqzDc0yszm6Ai8pD5d0AWglc5Mn9bd8Yp+E9pptlOtmon+ywKa1xFaXODWhblm aOPAEK0IyYooUv4TaKlMUC+9g/ljWTAKy52gI6PC6g2ZtJYIdAJZ8qq7MGssP348 Cv0G98J7/JqNuiLg2r0gnKBntLe8NG3PxcjUub8aSv9U2itdxdvO1xPQeu3zn1aR W9CrlFqBV5ap/2hmnA4AdiBsjWxtbPXa0eC3D8ncZGkcaQhH3EOMWbWhg9kxnPMp j5XLgCfKfn3iqQWUM3qtL4z3Soc+7L4MUQHVUU8Z4Taxic6idtnHfpCjCJZVn8Lc +CUxVZCejuKEKUmoovu9kxG3Lg9KJSKd3t5R1my2KYIzaGWP0xJk+ydAED7rRkum TG1g4DXn//KkRkKNO7QZjfIRMCZXWlC8tw2cZkm/hC4V9die8ggc8T4tpY8few7z ZTWWFrFAUgSSTRp2wMtlOFLXsf0rgw1X9mxQf98nbY2E5WP4X42LXPX0HY6KA4Y+ 6dn1i96Wi46oDo+XkA3CtjdOC/EVa58jiSL92Zy3kqLP4Ngz7F7zVQmc71McYcrq 2S15o/AgqIw=Sq1U -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Aug 05, 2021
•Important
Red Hat
100
security advisorySuSEremote accessSuSE Linux Security Alert: Serious Risk of Remote Access Vulnerability
It may be possible for an attacker to modify his/her DNS record to execute abitrary machine code as root while connecting to the standard ftp daemon.. -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: nkitb < 2000.7.11-0 Date: Fri Jul 14 14:38:37 CEST 2000 Affected SuSE versions: 6.1-6.4 Vulnerability Type: (possible) remote root compromise SuSE default package: yes Other affected systems: all linux systems using this package ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update it as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The standard ftp server does directly pass untrusted data from a DNS server to the setproctitle() function in a unsecure manner. 2. Impact It may be possible for an attacker to modify his/her DNS record to execute abitrary machine code as root while connecting to the standard ftp daemon. 3. Solution Update the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: (For SuSE 6.0, please use the 6.1 updates) AXP: 77ee118ac0790b775c08cecf28b3f5c3 5eac90efb3c82a948b7843a8d29b1c65 i386: c85b8c047395f87a61fe7ef1938facd6 /6.1/a1/nkitb-2000.7.11-0.i386.rpm 9fec7f48504f7c4134ac1ae78ee99060 /6.2/a1/nkitb-2000.7.11-0.i386.rpm 34540a50d4a562b02fbb4bc56f23e1b6 118075b7fc295be86b3659bf9b3fa778 /6.4/a1/nkitb-2000.7.11-0.i386.rpm PPC: 9ab22ed85cf0efb875c0c4f8fc878c3d 61608e1f8e8bd4f20d9f47bea6a70740 ______________________________________________________________________________ You can find updates on our ftp-Server: for Intel processors for Alpha processors or try the following web pages for a list of mirrors: SUSE – Open-Source-Lösungen für Enterprise Server und Cloud | SUSE Our webpage for patches: SUSE – Open-Source-Lösungen für Enterprise Server und Cloud | SUSE Our webpage for security announcements: SUSE – Open-Source-Lösungen für Enterprise Server und Cloud | SUSE If you want to report vulnerabilities, please contact
Jul 17, 2000
•Critical
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!