Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
100
security advisorysoftware updatemoderate severitySUSE: 2022:826-1 moderate security update for bci/ruby released
The container bci/ruby was updated. The following patches have been included in this update:. SUSE Container Update Advisory: bci/ruby ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2022:826-1 Container Tags : bci/ruby:2 , bci/ruby:2.5 , bci/ruby:2.5-17.3 , bci/ruby:latest Container Release : 17.3 Severity : moderate Type : security References : 1183533 1193489 CVE-2021-28153 ----------------------------------------------------------------- The container bci/ruby was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-RU-2022:1451-1 Released: Thu Apr 28 10:47:22 2022 Summary: Recommended update for perl Type: recommended Severity: moderate References: 1193489 This update for perl fixes the following issues: - Fix Socket::VERSION evaluation and stabilize Socket:VERSION comparisons (bsc#1193489) ----------------------------------------------------------------- Advisory ID: SUSE-SU-2022:1455-1 Released: Thu Apr 28 11:31:51 2022 Summary: Security update for glib2 Type: security Severity: low References: 1183533,CVE-2021-28153 This update for glib2 fixes the following issues: - CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files (bsc#1183533). The following package changes have been done: - libglib-2_0-0-2.62.6-150200.3.9.1 updated - perl-base-5.26.1-150300.17.3.1 updated - container:sles15-image-15.0.0-17.14.6 updated . SUSE Container Maintenance Notification for bci/python addresses vulnerabilities and implements essential updates for enhanced security and reliability.. bci/ruby update, container security, SUSE advisory, software patching. . LinuxSecurity.com Team
Apr 29, 2022
SuSE
98
security advisoryRed HatDoSRed Hat 8.1 RHSA-2022-0581 Critical: Ruby 2.6 DoS and Code Injection
An update for the ruby:2.6 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: ruby:2.6 security update Advisory ID: RHSA-2022:0581-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:0581 Issue date: 2022-02-21 CVE Names: CVE-2019-15845 CVE-2019-16201 CVE-2019-16254 CVE-2019-16255 CVE-2020-10663 CVE-2020-10933 CVE-2020-25613 CVE-2020-36327 CVE-2021-28965 CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 CVE-2021-41817 CVE-2021-41819 ==================================================================== 1. Summary: An update for the ruby:2.6 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream E4S (v. 8.1) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327) * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845) * ruby: Regular expression denial of service vulnerability ofWEBrick's Digest authentication (CVE-2019-16201) * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255) * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663) * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933) * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613) * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965) * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799) * ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810) * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817) * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819) * ruby: HTTP response splitting in WEBrick (CVE-2019-16254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1773728 - CVE-2019-16201 ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication 1789407 - CVE-2019-15845 ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? 1789556 - CVE-2019-16254 ruby: HTTP response splitting in WEBrick 1793683 - CVE-2019-16255 ruby: Code injection via command argument of Shell#test / Shell#[] 1827500 - CVE-2020-10663 rubygem-json: Unsafe object creation vulnerability in JSON 1833291 - CVE-2020-10933 ruby: BasicSocket#read_nonblock method leads to information disclosure 1883623 - CVE-2020-25613 ruby: Potential HTTP request smuggling in WEBrick 1947526 - CVE-2021-28965 ruby: XML round-trip vulnerability in REXML 1958999 - CVE-2020-36327rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source 1980126 - CVE-2021-31810 ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host 1980128 - CVE-2021-32066 ruby: StartTLS stripping vulnerability in Net::IMAP 1980132 - CVE-2021-31799 rubygem-rdoc: Command injection vulnerability in RDoc 2025104 - CVE-2021-41817 ruby: Regular expression denial of service vulnerability of Date parsing methods 2026757 - CVE-2021-41819 ruby: Cookie prefix spoofing in CGI::Cookie.parse 6. Package List: Red Hat Enterprise Linux AppStream E4S (v.8.1): Source: ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.src.rpm rubygem-abrt-0.3.0-4.module+el8.1.0+3653+beb38eb0.src.rpm rubygem-bson-4.5.0-1.module+el8.1.0+3653+beb38eb0.src.rpm rubygem-mongo-2.8.0-1.module+el8.1.0+3653+beb38eb0.src.rpm rubygem-mysql2-0.5.2-1.module+el8.1.0+3653+beb38eb0.src.rpm rubygem-pg-1.1.4-1.module+el8.1.0+3653+beb38eb0.src.rpm aarch64: ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.aarch64.rpm ruby-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.aarch64.rpm ruby-debugsource-2.6.9-107.module+el8.1.0+14088+04cf326e.aarch64.rpm ruby-devel-2.6.9-107.module+el8.1.0+14088+04cf326e.aarch64.rpm ruby-libs-2.6.9-107.module+el8.1.0+14088+04cf326e.aarch64.rpm ruby-libs-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-bigdecimal-1.4.1-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-bigdecimal-debuginfo-1.4.1-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-bson-4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-bson-debuginfo-4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-bson-debugsource-4.5.0-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-io-console-0.4.7-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-io-console-debuginfo-0.4.7-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-json-2.1.0-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-json-debuginfo-2.1.0-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-mysql2-0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-mysql2-debuginfo-0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-mysql2-debugsource-0.5.2-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-openssl-2.1.2-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-openssl-debuginfo-2.1.2-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-pg-1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-pg-debuginfo-1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-pg-debugsource-1.1.4-1.module+el8.1.0+3653+beb38eb0.aarch64.rpm rubygem-psych-3.1.0-107.module+el8.1.0+14088+04cf326e.aarch64.rpm rubygem-psych-debuginfo-3.1.0-107.module+el8.1.0+14088+04cf326e.aarch64.rpm noarch: ruby-doc-2.6.9-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-abrt-0.3.0-4.module+el8.1.0+3653+beb38eb0.noarch.rpm rubygem-abrt-doc-0.3.0-4.module+el8.1.0+3653+beb38eb0.noarch.rpm rubygem-bson-doc-4.5.0-1.module+el8.1.0+3653+beb38eb0.noarch.rpm rubygem-bundler-1.17.2-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-did_you_mean-1.3.0-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-irb-1.0.0-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-minitest-5.11.3-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-mongo-2.8.0-1.module+el8.1.0+3653+beb38eb0.noarch.rpm rubygem-mongo-doc-2.8.0-1.module+el8.1.0+3653+beb38eb0.noarch.rpm rubygem-mysql2-doc-0.5.2-1.module+el8.1.0+3653+beb38eb0.noarch.rpm rubygem-net-telnet-0.2.0-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-pg-doc-1.1.4-1.module+el8.1.0+3653+beb38eb0.noarch.rpm rubygem-power_assert-1.1.3-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-rake-12.3.3-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-rdoc-6.1.2.1-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-test-unit-3.2.9-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygem-xmlrpc-0.3.0-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygems-3.0.3.1-107.module+el8.1.0+14088+04cf326e.noarch.rpm rubygems-devel-3.0.3.1-107.module+el8.1.0+14088+04cf326e.noarch.rpm ppc64le: ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm ruby-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm ruby-debugsource-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm ruby-devel-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm ruby-libs-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm ruby-libs-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-bigdecimal-1.4.1-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-bigdecimal-debuginfo-1.4.1-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-bson-4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-bson-debuginfo-4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-bson-debugsource-4.5.0-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-io-console-0.4.7-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-io-console-debuginfo-0.4.7-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-json-2.1.0-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-json-debuginfo-2.1.0-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-mysql2-0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-mysql2-debuginfo-0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-mysql2-debugsource-0.5.2-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-openssl-2.1.2-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-openssl-debuginfo-2.1.2-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-pg-1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-pg-debuginfo-1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-pg-debugsource-1.1.4-1.module+el8.1.0+3653+beb38eb0.ppc64le.rpm rubygem-psych-3.1.0-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm rubygem-psych-debuginfo-3.1.0-107.module+el8.1.0+14088+04cf326e.ppc64le.rpm s390x: ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.s390x.rpm ruby-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.s390x.rpm ruby-debugsource-2.6.9-107.module+el8.1.0+14088+04cf326e.s390x.rpm ruby-devel-2.6.9-107.module+el8.1.0+14088+04cf326e.s390x.rpm ruby-libs-2.6.9-107.module+el8.1.0+14088+04cf326e.s390x.rpm ruby-libs-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-bigdecimal-1.4.1-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-bigdecimal-debuginfo-1.4.1-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-bson-4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-bson-debuginfo-4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-bson-debugsource-4.5.0-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-io-console-0.4.7-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-io-console-debuginfo-0.4.7-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-json-2.1.0-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-json-debuginfo-2.1.0-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-mysql2-0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-mysql2-debuginfo-0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-mysql2-debugsource-0.5.2-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-openssl-2.1.2-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-openssl-debuginfo-2.1.2-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-pg-1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-pg-debuginfo-1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-pg-debugsource-1.1.4-1.module+el8.1.0+3653+beb38eb0.s390x.rpm rubygem-psych-3.1.0-107.module+el8.1.0+14088+04cf326e.s390x.rpm rubygem-psych-debuginfo-3.1.0-107.module+el8.1.0+14088+04cf326e.s390x.rpm x86_64: ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.i686.rpm ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.x86_64.rpm ruby-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.i686.rpm ruby-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.x86_64.rpm ruby-debugsource-2.6.9-107.module+el8.1.0+14088+04cf326e.i686.rpm ruby-debugsource-2.6.9-107.module+el8.1.0+14088+04cf326e.x86_64.rpm ruby-devel-2.6.9-107.module+el8.1.0+14088+04cf326e.i686.rpm ruby-devel-2.6.9-107.module+el8.1.0+14088+04cf326e.x86_64.rpm ruby-libs-2.6.9-107.module+el8.1.0+14088+04cf326e.i686.rpm ruby-libs-2.6.9-107.module+el8.1.0+14088+04cf326e.x86_64.rpm ruby-libs-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.i686.rpm ruby-libs-debuginfo-2.6.9-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-bigdecimal-1.4.1-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-bigdecimal-1.4.1-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-bigdecimal-debuginfo-1.4.1-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-bigdecimal-debuginfo-1.4.1-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-bson-4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-bson-debuginfo-4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-bson-debugsource-4.5.0-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-io-console-0.4.7-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-io-console-0.4.7-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-io-console-debuginfo-0.4.7-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-io-console-debuginfo-0.4.7-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-json-2.1.0-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-json-2.1.0-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-json-debuginfo-2.1.0-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-json-debuginfo-2.1.0-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-mysql2-0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-mysql2-debuginfo-0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-mysql2-debugsource-0.5.2-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-openssl-2.1.2-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-openssl-2.1.2-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-openssl-debuginfo-2.1.2-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-openssl-debuginfo-2.1.2-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-pg-1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-pg-debuginfo-1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-pg-debugsource-1.1.4-1.module+el8.1.0+3653+beb38eb0.x86_64.rpm rubygem-psych-3.1.0-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-psych-3.1.0-107.module+el8.1.0+14088+04cf326e.x86_64.rpm rubygem-psych-debuginfo-3.1.0-107.module+el8.1.0+14088+04cf326e.i686.rpm rubygem-psych-debuginfo-3.1.0-107.module+el8.1.0+14088+04cf326e.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7.References: https://access.redhat.com/security/cve/CVE-2019-15845 https://access.redhat.com/security/cve/CVE-2019-16201 https://access.redhat.com/security/cve/CVE-2019-16254 https://access.redhat.com/security/cve/CVE-2019-16255 https://access.redhat.com/security/cve/CVE-2020-10663 https://access.redhat.com/security/cve/CVE-2020-10933 https://access.redhat.com/security/cve/CVE-2020-25613 https://access.redhat.com/security/cve/CVE-2020-36327 https://access.redhat.com/security/cve/CVE-2021-28965 https://access.redhat.com/security/cve/CVE-2021-31799 https://access.redhat.com/security/cve/CVE-2021-31810 https://access.redhat.com/security/cve/CVE-2021-32066 https://access.redhat.com/security/cve/CVE-2021-41817 https://access.redhat.com/security/cve/CVE-2021-41819 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/articles/6206172 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYhNmhNzjgjWX9erEAQhPpBAAnSDBgNUWVht2x3gS4/NBw6P99be64LD4 ms5DjSI/CHMpXU1CsbFEzzqvB3nSOBk53Ci4Yv4mdHYGVBfLtSFpZV25euf7Kig3 xCVqMS1nVefzIcFh+km4nTVI/Ocm6Fw1/m1FC0ECUxO66h8A9fuKsaAmUVTsw6E8 sPfsCV/ubWmPobpA94BkfEGlQks27Exlv+EdJYS6C9Zd5lSehDNHpXtPnHneCzNU OZg7j85Twc/IUmykrECD26Czj5YGU1v+CIEmSCsWpZTYEND101nwNZqnUnFyv/Xe P5VjRFHfUc9upPVsVUHRbBFL2WYuHm+bcIu3y3ThamRcBJ+FYJrhQT43wMYgf+ym AIBv0qWQbPnA0nrMU0ZuWzBSq5bqXd6Jl0J/xbbAajZVxsWJoXRa+kZUup2omUth d2TQAN551mdSSWBMU5rmQcZhe1LM3hId4QK2zcOEBxALllei8mwKs1HyQ1ARqM9l CbrAXsxAyl96WyH0NmYlfO+cnCbNqnPsYmi0YW/ARY3HBcogGGolKYuS9sqL/MO8 AlfZ2arlw8C7JAJSe3zrAzOCcNJnCMCfZ5e0L/qJpnT0knXdbX0YZ+RtfuCIP+CG o+B1a8tsY6jOKNIKrAbnA0duV4hKvMgVX208A6tUHlZhT3fKA+YVhluGGnYfqhuL yZlifMazDWc=FIra -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Feb 21, 2022
•Important
Red Hat
98
security advisorysecurity issuered hatRedHat: RHSA-2021-3982-01 Important: Ruby Security Update
An update for rh-ruby30-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: rh-ruby30-ruby security update Advisory ID: RHSA-2021:3982-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2021:3982 Issue date: 2021-10-25 CVE Names: CVE-2020-36327 CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 ==================================================================== 1. Summary: An update for rh-ruby30-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: rh-ruby30-ruby (3.0.2). Security Fix(es): * rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327) * rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799) * ruby: FTP PASV command response can causeNet::FTP to connect to arbitrary host (CVE-2021-31810) * ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1958999 - CVE-2020-36327 rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source 1980126 - CVE-2021-31810 ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host 1980128 - CVE-2021-32066 ruby: StartTLS stripping vulnerability in Net::IMAP 1980132 - CVE-2021-31799 rubygem-rdoc: Command injection vulnerability in RDoc 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v.7): Source: rh-ruby30-ruby-3.0.2-148.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.2-148.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.2-148.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.22-148.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-148.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-148.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-148.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-148.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.0.4-148.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-148.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-148.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-148.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.12.0-148.el7.noarch.rpm rh-ruby30-rubygems-3.2.22-148.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.22-148.el7.noarch.rpm ppc64le: rh-ruby30-ruby-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.ppc64le.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.ppc64le.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.ppc64le.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.ppc64le.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.ppc64le.rpm s390x: rh-ruby30-ruby-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.s390x.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.s390x.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.s390x.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.s390x.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.s390x.rpm x86_64: rh-ruby30-ruby-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v.7.7): Source: rh-ruby30-ruby-3.0.2-148.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.2-148.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.2-148.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.22-148.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-148.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-148.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-148.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-148.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.0.4-148.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-148.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-148.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-148.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.12.0-148.el7.noarch.rpm rh-ruby30-rubygems-3.2.22-148.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.22-148.el7.noarch.rpm ppc64le: rh-ruby30-ruby-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.ppc64le.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.ppc64le.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.ppc64le.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.ppc64le.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.ppc64le.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.ppc64le.rpm s390x: rh-ruby30-ruby-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.s390x.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.s390x.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.s390x.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.s390x.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.s390x.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.s390x.rpm x86_64: rh-ruby30-ruby-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v.7): Source: rh-ruby30-ruby-3.0.2-148.el7.src.rpm noarch: rh-ruby30-ruby-default-gems-3.0.2-148.el7.noarch.rpm rh-ruby30-ruby-doc-3.0.2-148.el7.noarch.rpm rh-ruby30-rubygem-bundler-2.2.22-148.el7.noarch.rpm rh-ruby30-rubygem-irb-1.3.5-148.el7.noarch.rpm rh-ruby30-rubygem-minitest-5.14.2-148.el7.noarch.rpm rh-ruby30-rubygem-power_assert-1.2.0-148.el7.noarch.rpm rh-ruby30-rubygem-rake-13.0.3-148.el7.noarch.rpm rh-ruby30-rubygem-rbs-1.0.4-148.el7.noarch.rpm rh-ruby30-rubygem-rexml-3.2.5-148.el7.noarch.rpm rh-ruby30-rubygem-rss-0.2.9-148.el7.noarch.rpm rh-ruby30-rubygem-test-unit-3.3.7-148.el7.noarch.rpm rh-ruby30-rubygem-typeprof-0.12.0-148.el7.noarch.rpm rh-ruby30-rubygems-3.2.22-148.el7.noarch.rpm rh-ruby30-rubygems-devel-3.2.22-148.el7.noarch.rpm x86_64: rh-ruby30-ruby-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-debuginfo-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-devel-3.0.2-148.el7.x86_64.rpm rh-ruby30-ruby-libs-3.0.2-148.el7.x86_64.rpm rh-ruby30-rubygem-bigdecimal-3.0.0-148.el7.x86_64.rpm rh-ruby30-rubygem-io-console-0.5.7-148.el7.x86_64.rpm rh-ruby30-rubygem-json-2.5.1-148.el7.x86_64.rpm rh-ruby30-rubygem-psych-3.3.0-148.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-36327 https://access.redhat.com/security/cve/CVE-2021-31799 https://access.redhat.com/security/cve/CVE-2021-31810 https://access.redhat.com/security/cve/CVE-2021-32066 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYXcY89zjgjWX9erEAQgpFw/8CYxgU75ccdXpB75Wwh1wDSGvE65RwC/Z 4gPKdsXyOznJZhxgePOP7Vy0p/n3f1F6wlZEPDSsBnrKyhCsBoq5vKDBE+gtrkqC /k4W7RLW1IOb/ULi87RpABonZQQPWJr0jj+FC9o42qwAl4CAvDb1JiNaoGeQaOzy D+HYIVfR/Oqkeenet9rRsc/Fmjr0XvglcbRCRcLj7sXzbQo1xYWF0Z9FYBJIXqGW f8nl49x6NgguQt/O3jDhJkOWjAJfVANbP9K87noJzwkSEssc6KcUUlPJR0Wf40Xu YJVBuScEBUlQ6417eRzL7wmg9yNlDFTUw6JAwuLDdv6xKNMd5/UsbI5ALYn9LdLp eaPCPI3FC9kWyee8M9osri+Y0qNDjM5QlVBVMaw86jVwOdzoz7NxIlxo7lQQAZ/z CazS+gmpcFpu8xtu10KwCVSzNRucZ1h9sEB8fljzn+OHdTCCnbKB+V1L8uKFowdc OMvg/P73onKkRpZNFK/PIKWGZK7wgbpCxEvwbhldESpmqalJXjhJGC/BErXRBbIo 9S7h3ZjdoFlucK3QlZPdTDy6bC8lUxmQuy4q3Cqw7tCV6nc0hgdKLtglEx55ydSw VBv2iXp4jkLIDzDLl+XRF9NFYxWSqJ4DEUJIzB82yf7tULPKRvT0m7ABqmEj1/nR bVDldz4OTwk=pQWj -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Oct 25, 2021
•Important
Red Hat
100
security advisorysoftware updatemoderate severitySUSE: 2021-1280-1 Moderate Vulnerability in Ruby2.5 XML Handling
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for ruby2.5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:1280-1 Rating: moderate References: #1184644 Cross-References: CVE-2021-28965 CVSS scores: CVE-2021-28965 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: SUSE MicroOS 5.0 SUSE Linux Enterprise Module for Basesystem 15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ruby2.5 fixes the following issues: - Update to 2.5.9 - CVE-2021-28965: XML round-trip vulnerability in REXML (bsc#1184644) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE MicroOS 5.0: zypper in -t patch SUSE-SUSE-MicroOS-5.0-2021-1280=1 - SUSE Linux Enterprise Module for Basesystem 15-SP2: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2021-1280=1 Package List: - SUSE MicroOS 5.0 (aarch64 x86_64): libruby2_5-2_5-2.5.9-4.17.1 libruby2_5-2_5-debuginfo-2.5.9-4.17.1 ruby2.5-2.5.9-4.17.1 ruby2.5-debuginfo-2.5.9-4.17.1 ruby2.5-debugsource-2.5.9-4.17.1 ruby2.5-stdlib-2.5.9-4.17.1 ruby2.5-stdlib-debuginfo-2.5.9-4.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64): libruby2_5-2_5-2.5.9-4.17.1 libruby2_5-2_5-debuginfo-2.5.9-4.17.1 ruby2.5-2.5.9-4.17.1 ruby2.5-debuginfo-2.5.9-4.17.1 ruby2.5-debugsource-2.5.9-4.17.1 ruby2.5-devel-2.5.9-4.17.1 ruby2.5-devel-extra-2.5.9-4.17.1 ruby2.5-stdlib-2.5.9-4.17.1 ruby2.5-stdlib-debuginfo-2.5.9-4.17.1 References: https://www.suse.com/security/cve/CVE-2021-28965.html https://bugzilla.suse.com/1184644 . SUSE Security Advisory: Enhancements for ruby2.5 resolve XML round-trip vulnerabilities. Please check for remediation steps.. SUSE Security Update,ruby2.5 patch,xml round-trip fix,software maintenance. . LinuxSecurity.com Team
Apr 20, 2021
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!