Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 5 articles for you...
100
security advisoryimportantsuseSUSE: 2025:01586-2 important: rack session fixation and memory issues
* bsc#1242894 * bsc#1242899 Cross-References: * CVE-2025-32441 . # Security update for rubygem-rack Announcement ID: SUSE-SU-2025:01586-2 Release Date: 2025-06-03T09:17:07Z Rating: important References: * bsc#1242894 * bsc#1242899 Cross-References: * CVE-2025-32441 * CVE-2025-46727 CVSS scores: * CVE-2025-32441 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-32441 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2025-32441 ( NVD ): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2025-46727 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2025-46727 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2025-46727 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise High Availability Extension 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves two vulnerabilities can now be installed. ## Description: This update for rubygem-rack fixes the following issues: * CVE-2025-46727: possible memory exhaustion due to unbounded parameter parsing in Rack::QueryParser (bsc#1242894). * CVE-2025-32441: deleted sessions can be restored and occupied by unauthenticated users when the Rack::Session::Pool middleware is being used (bsc#1242899). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Availability Extension 15 SP7 zypper in -t patch SUSE-SLE-Product-HA-15-SP7-2025-1586=1 ## Package List: * SUSE Linux Enterprise High Availability Extension 15 SP7 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.31.1 ## References: * https://www.suse.com/security/cve/CVE-2025-32441.html *https://www.suse.com/security/cve/CVE-2025-46727.html * https://bugzilla.suse.com/show_bug.cgi?id=1242894 * https://bugzilla.suse.com/show_bug.cgi?id=1242899 . SUSE's latest release tackles Rack complications, resolving memory depletion and enhancing session restoration. Discover further details within.. rubygem-rack, update instructions, security issues. . Severity: Important. LinuxSecurity.com Team
Jun 04, 2025
•Important
SuSE
202
security advisorymoderatethreat mitigationopenSUSE Tumbleweed: 2025:15067-1 moderate: ruby rack security update
An update that solves one vulnerability can now be installed.. # ruby3.4-rubygem-rack-2.2-2.2.14-1.1 on GA media Announcement ID: openSUSE-SU-2025:15067-1 Rating: moderate Cross-References: * CVE-2025-46727 CVSS scores: * CVE-2025-46727 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2025-46727 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.14-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * ruby3.4-rubygem-rack-2.2 2.2.14-1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-46727.html . Notice for ruby3.4-rubygem-rack on openSUSE related to a significant vulnerability. Please upgrade to the newest version to maintain security.. ruby3, openSUSE update, security patch, rack gem, moderate severity. . LinuxSecurity.com Team
May 09, 2025
OpenSUSE
100
security advisoryimportantSUSESUSE: 2025:0858-1 important: rubygem-rack-1_6 Security Advisory Updates
* bsc#1237141 * bsc#1239298 Cross-References: * CVE-2025-25184 . # Security update for rubygem-rack-1_6 Announcement ID: SUSE-SU-2025:0858-1 Release Date: 2025-03-13T17:58:53Z Rating: important References: * bsc#1237141 * bsc#1239298 Cross-References: * CVE-2025-25184 * CVE-2025-27610 CVSS scores: * CVE-2025-25184 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-25184 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2025-25184 ( NVD ): 5.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-27610 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2025-27610 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2025-27610 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.6 An update that solves two vulnerabilities can now be installed. ## Description: This update for rubygem-rack-1_6 fixes the following issues: * CVE-2025-27610: Fixed improper sanitization of user-supplied paths when serving files leading to local file inclusion (bsc#1239298). * CVE-2025-25184: Fixed Rack::CommonLogger log entry manipulation (bsc#1237141). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-858=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-1_6-1.6.8-150000.3.3.1 * ruby2.5-rubygem-rack-testsuite-1_6-1.6.8-150000.3.3.1 * ruby2.5-rubygem-rack-doc-1_6-1.6.8-150000.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2025-25184.html *https://www.suse.com/security/cve/CVE-2025-27610.html * https://bugzilla.suse.com/show_bug.cgi?id=1237141 * https://bugzilla.suse.com/show_bug.cgi?id=1239298 . Important SUSE maintenance updates address two vulnerabilities in rubygem-rack-1_6 affecting openSUSE Leap 15.6.. bsc#1237141, bsc#1239298, cross-references, cve-2025-25184, security, update, rubygem-rack-1_. . Severity: Important. LinuxSecurity.com Team
Mar 13, 2025
•Important
SuSE
202
security advisorypatchimportantopenSUSE: 2025:0858-1 important: rubygem-rack-1_6 Advisory Security Update
An update that solves two vulnerabilities can now be installed.. # Security update for rubygem-rack-1_6 Announcement ID: SUSE-SU-2025:0858-1 Release Date: 2025-03-13T17:58:53Z Rating: important References: * bsc#1237141 * bsc#1239298 Cross-References: * CVE-2025-25184 * CVE-2025-27610 CVSS scores: * CVE-2025-25184 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-25184 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2025-25184 ( NVD ): 5.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-27610 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2025-27610 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2025-27610 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.6 An update that solves two vulnerabilities can now be installed. ## Description: This update for rubygem-rack-1_6 fixes the following issues: * CVE-2025-27610: Fixed improper sanitization of user-supplied paths when serving files leading to local file inclusion (bsc#1239298). * CVE-2025-25184: Fixed Rack::CommonLogger log entry manipulation (bsc#1237141). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-858=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-1_6-1.6.8-150000.3.3.1 * ruby2.5-rubygem-rack-testsuite-1_6-1.6.8-150000.3.3.1 * ruby2.5-rubygem-rack-doc-1_6-1.6.8-150000.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2025-25184.html *https://www.suse.com/security/cve/CVE-2025-27610.html * https://bugzilla.suse.com/show_bug.cgi?id=1237141 * https://bugzilla.suse.com/show_bug.cgi?id=1239298 . An important security update for openSUSE fixes two critical issues in rubygem-rack. Stay secure and patch now!. update, solves, vulnerabilities, installed, security, rubygem-rack-1. . Severity: Important. LinuxSecurity.com Team
Mar 13, 2025
•Important
OpenSUSE
202
security advisorymoderatesecurity issueopenSUSE Tumbleweed 2025:14859-1 moderate: ruby rack security advisory
An update that solves one vulnerability can now be installed.. # ruby3.4-rubygem-rack-2.2-2.2.12-1.1 on GA media Announcement ID: openSUSE-SU-2025:14859-1 Rating: moderate Cross-References: * CVE-2025-27111 CVSS scores: * CVE-2025-27111 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2025-27111 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.12-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * ruby3.4-rubygem-rack-2.2 2.2.12-1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-27111.html . A fix has been released for a moderate security vulnerability in ruby3.4-rubygem-rack on openSUSE Tumbleweed. Refer to the detailed CVE for more information.. openSUSE security update, ruby rack moderate fix, software vulnerability advisory, package update details. . LinuxSecurity.com Team
Mar 07, 2025
OpenSUSE
202
security advisorymoderatesecurity updateopenSUSE Tumbleweed: 2025:14811-1 moderate: ruby3.4-rubygem-rack
An update that solves 17 vulnerabilities can now be installed.. # ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media Announcement ID: openSUSE-SU-2025:14811-1 Rating: moderate Cross-References: * CVE-2013-0262 * CVE-2013-0263 * CVE-2015-3225 * CVE-2018-16471 * CVE-2019-16782 * CVE-2020-8184 * CVE-2022-30122 * CVE-2022-30123 * CVE-2022-44570 * CVE-2022-44571 * CVE-2022-44572 * CVE-2023-27530 * CVE-2023-27539 * CVE-2024-25126 * CVE-2024-26141 * CVE-2024-26146 * CVE-2025-25184 CVSS scores: * CVE-2018-16471 ( SUSE ): 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2019-16782 ( SUSE ): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2020-8184 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2022-30122 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2022-30123 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2022-44570 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-44571 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-44572 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-27530 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-27539 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-25126 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-26141 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-26146 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-25184 ( SUSE ): 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2025-25184 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 17 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: *ruby3.4-rubygem-rack-2.2 2.2.11-1.1 ## References: * https://www.suse.com/security/cve/CVE-2013-0262.html * https://www.suse.com/security/cve/CVE-2013-0263.html * https://www.suse.com/security/cve/CVE-2015-3225.html * https://www.suse.com/security/cve/CVE-2018-16471.html * https://www.suse.com/security/cve/CVE-2019-16782.html * https://www.suse.com/security/cve/CVE-2020-8184.html * https://www.suse.com/security/cve/CVE-2022-30122.html * https://www.suse.com/security/cve/CVE-2022-30123.html * https://www.suse.com/security/cve/CVE-2022-44570.html * https://www.suse.com/security/cve/CVE-2022-44571.html * https://www.suse.com/security/cve/CVE-2022-44572.html * https://www.suse.com/security/cve/CVE-2023-27530.html * https://www.suse.com/security/cve/CVE-2023-27539.html * https://www.suse.com/security/cve/CVE-2024-25126.html * https://www.suse.com/security/cve/CVE-2024-26141.html * https://www.suse.com/security/cve/CVE-2024-26146.html * https://www.suse.com/security/cve/CVE-2025-25184.html . A security patch has been released for ruby3.4-rubygem-rack in openSUSE Tumbleweed to fix 17 vulnerabilities.. ruby3.4,rack,security update,openSUSE,software fix. . LinuxSecurity.com Team
Feb 15, 2025
OpenSUSE
172
security advisorydenial of servicesecurity issueUbuntu 24.04 LTS USN-6837-1 Moderate: Rack Denial Of Service
Several security issues were fixed in Rack.. ========================================================================== Ubuntu Security Notice USN-6837-1 June 17, 2024 ruby-rack vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 23.10 Summary: Several security issues were fixed in Rack. Software Description: - ruby-rack: modular Ruby webserver interface Details: It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-27530) It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126) It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly use this issue to cause Rack to create large responses, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26141) It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26146) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS ruby-rack 2.2.7-1ubuntu0.1 Ubuntu 23.10 ruby-rack 2.2.4-3ubuntu0.2 After a standard system update you need to restart any applications using Rack to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6837-1 CVE-2023-27530, CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 Package Information: https://launchpad.net/ubuntu/+source/ruby-rack/2.2.7-1ubuntu0.1 https://launchpad.net/ubuntu/+source/ruby-rack/2.2.4-3ubuntu0.2 . Multiple vulnerabilities impacting Ruby Rack in Ubuntu 24.04 LTS and 23.10 necessitate urgent action to ensure security.. rack security,ruby vulnerability,ubuntu update,denial of service,resource management. . Severity: Important. LinuxSecurity.com Team
Jun 17, 2024
•Important
Ubuntu
172
security advisorydenial of servicesoftware updateUbuntu 23.10 USN-6689-1 Moderate: Rack Denial Of Service Issue
Rack could be made do denial of service if it received a specially crafted header.. ========================================================================== Ubuntu Security Notice USN-6689-1 March 12, 2024 ruby-rack vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 Summary: Rack could be made do denial of service if it received a specially crafted header. Software Description: - ruby-rack: modular Ruby webserver interface Details: It was discovered that Rack incorrectly parse some headers. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-27539, CVE-2024-26141, CVE-2024-26146) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: ruby-rack 2.2.4-3ubuntu0.1 In general, a standard system update will make all the necessary changes. References: CVE-2023-27539, CVE-2024-26141, CVE-2024-26146 Package Information: https://launchpad.net/ubuntu/+source/ruby-rack/2.2.4-3ubuntu0.1 . Ubuntu Security Advisory USN-6689-1 tackles rack-based denial of service vulnerabilities and offers guidance for applying updates.. ubuntu rack issues, denial service threats, ruby webserver security. . LinuxSecurity.com Team
Mar 12, 2024
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!