Stay Secure with the Latest Linux Advisories

security advisorydebianupgrade

Debian LTS DLA-2943-1: ruby-sidekiq XSS and Overload Issues

ruby-sidekiq, a simple, efficient background processing for Ruby, had a couple of vulnerabilities as follows: CVE-2021-30151 . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2943-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Utkarsh Gupta March 10, 2022 https://wiki.debian.org/LTS - ----------------------------------------------------------------------- Package : ruby-sidekiq Version : 4.2.3+dfsg-1+deb9u1 CVE ID : CVE-2021-30151 CVE-2022-23837 Debian Bug : 987354 1004193 ruby-sidekiq, a simple, efficient background processing for Ruby, had a couple of vulnerabilities as follows: CVE-2021-30151 Sidekiq allows XSS via the queue name of the live-poll feature when Internet Explorer is used. CVE-2022-23837 In api.rb in Sidekiq, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users. For Debian 9 stretch, these problems have been fixed in version 4.2.3+dfsg-1+deb9u1. We recommend that you upgrade your ruby-sidekiq packages. For the detailed security status of ruby-sidekiq please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/ruby-sidekiq Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS Advisory DLA-2944-2 outlines the security updates for python-django addressing CVE-2021-30152 and CVE-2022-23838.. Ruby-Sidekiq Security, Debian Update, XSS Issues, Overload Problems. . Severity: Important. LinuxSecurity.com Team

Mar 10, 2022 •Important Debian LTS