Stay Secure with the Latest Linux Advisories

security advisorycriticaldebian

Debian: DLA-3150-1 Critical: Rexical Command Injection Issue

A command injection vulnerability was found in Rexical, a lexical scanner generator for the Ruby programming language. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3150-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Sylvain Beucler October 12, 2022 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : rexical Version : 1.0.5-2+deb10u1 CVE ID : CVE-2019-5477 Debian Bug : 940905 A command injection vulnerability was found in Rexical, a lexical scanner generator for the Ruby programming language. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem. For Debian 10 buster, this problem has been fixed in version 1.0.5-2+deb10u1. We recommend that you upgrade your rexical packages. For the detailed security status of rexical please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/rexical Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Ubuntu Security Notice USN-5283-1 outlines a vulnerability in Dataproc with guidance on how to mitigate the problem.. Debian LTS, Rexical Security Update, Command Injection Risk. . Severity: Critical. LinuxSecurity.com Team

Oct 12, 2022 •Critical Debian LTS