Stay Secure with the Latest Linux Advisories

security advisorysecurity updatedebian

Debian 10 Buster DLA-3360-1 Critical: ruby-sidekiq XSS & Remote Disruption

ruby-sidekiq, a simple, efficient background processing for Ruby, had a couple of vulnerabilities as follows: CVE-2021-30151 . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-3360-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Utkarsh Gupta March 13, 2023 https://wiki.debian.org/LTS - ----------------------------------------------------------------------- Package : ruby-sidekiq Version : 5.2.3+dfsg-1+deb10u1 CVE ID : CVE-2021-30151 CVE-2022-23837 Debian Bug : 987354 1004193 ruby-sidekiq, a simple, efficient background processing for Ruby, had a couple of vulnerabilities as follows: CVE-2021-30151 Sidekiq allows XSS via the queue name of the live-poll feature when Internet Explorer is used. CVE-2022-23837 In api.rb in Sidekiq, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users. For Debian 10 buster, these problems have been fixed in version 5.2.3+dfsg-1+deb10u1. We recommend that you upgrade your ruby-sidekiq packages. For the detailed security status of ruby-sidekiq please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/ruby-sidekiq Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS provides an essential security patch for python-scrapy, tackling several vulnerabilities. Update strongly advised for all users.. Debian LTS, ruby-sidekiq, security update, XSS, service interruption. . Severity: Critical. LinuxSecurity.com Team

Mar 12, 2023 •Critical Debian LTS