Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 0 articles for you...
197
security advisorydenial of servicesecurity issueDebian 10: DLA-3408-1 High: JRuby HTTP Attack Mitigations
Several vulnerabilities were fixed in JRuby, a Java implementation of the Ruby programming language. CVE-2017-17742 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3408-1
Apr 30, 2023
Debian LTS
203
security advisoryDoSarbitrary code executionMageia 7 MGASA-2020-0440 Critical: Jruby Escape Sequence Issues
Response Splitting attack in the HTTP server of WEBrick (CVE-2017-17742). Delete directory using symlink when decompressing tar (CVE-2019-8320). Escape sequence injection vulnerability in verbose (CVE-2019-8321). . MGASA-2020-0440 - Updated jruby packages fix security vulnerabilities Publication date: 27 Nov 2020 URL: https://advisories.mageia.org/MGASA-2020-0440.html Type: security Affected Mageia releases: 7 CVE: CVE-2017-17742, CVE-2019-8320, CVE-2019-8321, CVE-2019-8322, CVE-2019-8323, CVE-2019-8324, CVE-2019-8325, CVE-2019-16201, CVE-2019-16254, CVE-2019-16255, CVE-2020-25613 Response Splitting attack in the HTTP server of WEBrick (CVE-2017-17742). Delete directory using symlink when decompressing tar (CVE-2019-8320). Escape sequence injection vulnerability in verbose (CVE-2019-8321). Escape sequence injection vulnerability in gem owner (CVE-2019-8322). Escape sequence injection vulnerability in API response handling (CVE-2019-8323). Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324). Escape sequence injection vulnerability in errors (CVE-2019-8325). Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication (CVE-2019-16201). HTTP Response Splitting attack in the HTTP server of WEBrick (CVE-2019-16254). Code injection vulnerability (CVE-2019-16255). A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with jruby) was too tolerant against an invalid Transfer-Encoding header. This may lead to inconsistent interpretation between WEBrick and some HTTP proxy servers, which may allow the attacker to "smuggle" a request (CVE-2020-25613). References: - https://bugs.mageia.org/show_bug.cgi?id=27402 - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00003.html - https://bugs.mageia.org/show_bug.cgi?id=25875 - https://bugs.mageia.org/show_bug.cgi?id=27402 -https://www.cve.org/CVERecord?id=CVE-2017-17742 - https://www.cve.org/CVERecord?id=CVE-2019-8320 - https://www.cve.org/CVERecord?id=CVE-2019-8321 - https://www.cve.org/CVERecord?id=CVE-2019-8322 - https://www.cve.org/CVERecord?id=CVE-2019-8323 - https://www.cve.org/CVERecord?id=CVE-2019-8324 - https://www.cve.org/CVERecord?id=CVE-2019-8325 - https://www.cve.org/CVERecord?id=CVE-2019-16201 - https://www.cve.org/CVERecord?id=CVE-2019-16254 - https://www.cve.org/CVERecord?id=CVE-2019-16255 - https://www.cve.org/CVERecord?id=CVE-2020-25613 SRPMS: - 7/core/jruby-1.7.22-7.2.mga7 . Mageia 2021-0450 releases updates for ruby packages rectifying serious security concerns stemming from various flaws.. Mageia 7, Jruby Security, Vulnerability Fixes, Security Update, Response Splitting. . Severity: Critical. LinuxSecurity.com Team
Nov 27, 2020
•Critical
Mageia
197
security advisoryupdatedebianDebian LTS: DLA-2392-1 Critical WEBrick Request Smuggling Issue
A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with jruby) was too tolerant against . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2392-1
Oct 01, 2020
•Critical
Debian LTS
197
security advisorydenial of servicedebianDebian 9: DLA-2330-1 Moderate: JRuby Security Update for Multiple Issues
Several vulnerabilities were fixed in JRuby, a 100% pure-Java implementation of Ruby. CVE-2017-17742 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2330-1
Aug 16, 2020
•Important
Debian LTS
197
security advisoryDebiandenial-of-serviceDebian 8: DLA-2027-1 Critical: jruby Denial of Service Threat
Several security vulnerabilities were found in Ruby that also affected Debian's JRuby package, a pure-Java implementation of Ruby. Attackers were able to call arbitrary Ruby methods, cause a denial-of-service or inject input into HTTP response headers when using the WEBrick module. . Package : jruby Version : 1.5.6-9+deb8u2 CVE ID : CVE-2017-17742 CVE-2019-16201 CVE-2019-16254 CVE-2019-16255 Several security vulnerabilities were found in Ruby that also affected Debian's JRuby package, a pure-Java implementation of Ruby. Attackerswere able to call arbitrary Ruby methods, cause a denial-of-service or inject input into HTTP response headers when using the WEBrick module. For Debian 8 "Jessie", these problems have been fixed in version 1.5.6-9+deb8u2. We recommend that you upgrade your jruby packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Urgent security notice for Debian's JRuby distribution highlighting vulnerabilities. Prompt upgrade advised for enhanced safety.. Debian LTS Updates,jruby Security Patches,Denial of Service Fixes. . Severity: Critical. LinuxSecurity.com Team
Dec 10, 2019
•Critical
Debian LTS
197
security advisorycode executionXSSDebian: DLA-1796-1 Moderate: Jruby Code Execution and XSS Issues
Multiple vulnerabilities have been discovered in jruby, Java implementation of the Ruby programming language. . Package : jruby Version : 1.5.6-9+deb8u1 CVE ID : CVE-2018-1000074 CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 CVE-2019-8321 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325 Debian Bug : 895778 925987 Multiple vulnerabilities have been discovered in jruby, Java implementation of the Ruby programming language. CVE-2018-1000074 Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file CVE-2018-1000075 an infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop CVE-2018-1000076 Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures. CVE-2018-1000077 Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server CVE-2019-8321 Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible CVE-2019-8322 The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur CVE-2019-8323 Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, ifthe API side modifies the response, escape sequence injection may occur. CVE-2019-8324 A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec CVE-2019-8325 Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) For Debian 8 "Jessie", these problems have been fixed in version 1.5.6-9+deb8u1. We recommend that you upgrade your jruby packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Enhance your jruby installations to resolve various security flaws in version 1.5.6-9+deb8u1 and fortify your environment.. jruby security update, Debian LTS, software vulnerability, programming language flaw, Java implementation flaw. . LinuxSecurity.com Team
May 20, 2019
Debian LTS
203
security advisorydenial of servicecross-site scriptingMageia: 2019-0062 Moderate: Jruby Critical Security Advisory
Several vulnerabilities were discovered in jruby. They would allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code (CVE-2018-1000073, CVE-2018-1000074, CVE-2018-1000075, CVE-2018-1000076, CVE-2018-1000077, CVE-2018-1000078, . MGASA-2019-0062 - Updated jruby packages fix security vulnerability Publication date: 13 Feb 2019 URL: https://advisories.mageia.org/MGASA-2019-0062.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-1000073, CVE-2018-1000074, CVE-2018-1000075, CVE-2018-1000076, CVE-2018-1000077, CVE-2018-1000078, CVE-2018-1000079 Several vulnerabilities were discovered in jruby. They would allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code (CVE-2018-1000073, CVE-2018-1000074, CVE-2018-1000075, CVE-2018-1000076, CVE-2018-1000077, CVE-2018-1000078, CVE-2018-1000079). References: - https://bugs.mageia.org/show_bug.cgi?id=23158 - https://lists.debian.org/debian-security-announce/2018/msg00148.html - https://www.cve.org/CVERecord?id=CVE-2018-1000073 - https://www.cve.org/CVERecord?id=CVE-2018-1000074 - https://www.cve.org/CVERecord?id=CVE-2018-1000075 - https://www.cve.org/CVERecord?id=CVE-2018-1000076 - https://www.cve.org/CVERecord?id=CVE-2018-1000077 - https://www.cve.org/CVERecord?id=CVE-2018-1000078 - https://www.cve.org/CVERecord?id=CVE-2018-1000079 SRPMS: - 6/core/jruby-1.7.22-5.1.mga6 . Latest jruby updates tackle critical security flaws, providing enhanced protection for Mageia systems following the identification of major vulnerabilities.. jruby Security, Mageia Updates, Cross-Site Scripting, Denial of Service, Update Advisory. . LinuxSecurity.com Team
Feb 13, 2019
Mageia
87
security advisorydenial of servicesecurity updateDebian 9: DSA-4219-1 Urgent: Jruby Denial Of Service Vulnerability
Several vulnerabilities were discovered in jruby, a Java implementation of the Ruby programming language. They would allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4219-1
Jun 08, 2018
•Important
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!