Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 55 articles for you...
100
security advisorysession managementsuseSUSE Linux: 2025:01586-1 important: rubygem-rack session management flaw
* bsc#1242894 * bsc#1242899 Cross-References: * CVE-2025-32441 . # Security update for rubygem-rack Announcement ID: SUSE-SU-2025:01586-1 Release Date: 2025-05-19T17:23:48Z Rating: important References: * bsc#1242894 * bsc#1242899 Cross-References: * CVE-2025-32441 * CVE-2025-46727 CVSS scores: * CVE-2025-32441 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-32441 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2025-32441 ( NVD ): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2025-46727 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2025-46727 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2025-46727 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Availability Extension 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now beinstalled. ## Description: This update for rubygem-rack fixes the following issues: * CVE-2025-46727: possible memory exhaustion due to unbounded parameter parsing in Rack::QueryParser (bsc#1242894). * CVE-2025-32441: deleted sessions can be restored and occupied by unauthenticated users when the Rack::Session::Pool middleware is being used (bsc#1242899). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1586=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2025-1586=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2025-1586=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2025-1586=1 * SUSE Linux Enterprise High Availability Extension 15 SP6 zypper in -t patch SUSE-SLE-Product-HA-15-SP6-2025-1586=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-testsuite-2.0.8-150000.3.31.1 * ruby2.5-rubygem-rack-2.0.8-150000.3.31.1 * ruby2.5-rubygem-rack-doc-2.0.8-150000.3.31.1 * SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.31.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.31.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.31.1 * SUSE Linux Enterprise High Availability Extension 15 SP6 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.31.1 ## References: * https://www.suse.com/security/cve/CVE-2025-32441.html *https://www.suse.com/security/cve/CVE-2025-46727.html * https://bugzilla.suse.com/show_bug.cgi?id=1242894 * https://bugzilla.suse.com/show_bug.cgi?id=1242899 . A patch has been issued for rubygem-rack addressing significant vulnerabilities and enhancing protection across multiple SUSE releases.. rubygem-rack, SUSE security update, memory exhaustion issue, session management fix. . Severity: Important. LinuxSecurity.com Team
May 19, 2025
•Important
SuSE
100
security advisorysoftware updatemoderate severityopenSUSE Leap 15.6: SUSE-SU-2025:1492-1 moderate: rubygem escape injection
* bsc#1238607 Cross-References: * CVE-2025-27111 . # Security update for rubygem-rack-1_6 Announcement ID: SUSE-SU-2025:1492-1 Release Date: 2025-05-06T14:36:05Z Rating: moderate References: * bsc#1238607 Cross-References: * CVE-2025-27111 CVSS scores: * CVE-2025-27111 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-27111 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2025-27111 ( NVD ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * openSUSE Leap 15.6 An update that solves one vulnerability can now be installed. ## Description: This update for rubygem-rack-1_6 fixes the following issues: * CVE-2025-27111: Fixed Escape Sequence Injection vulnerability (bsc#1238607) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1492=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-1_6-1.6.8-150000.3.6.1 * ruby2.5-rubygem-rack-testsuite-1_6-1.6.8-150000.3.6.1 * ruby2.5-rubygem-rack-doc-1_6-1.6.8-150000.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2025-27111.html * https://bugzilla.suse.com/show_bug.cgi?id=1238607 . This patch resolves a significant vulnerability related to escape sequence handling in rubygem-rack-1_6 for openSUSE Leap 15.6.. rubygem rack, openSUSE security, escape injection fix, software patch, SUSE updates. . LinuxSecurity.com Team
May 07, 2025
SuSE
100
security advisorysecurity issueupdateSUSE: 2025:1294-1 important: rubygem-bundler security patch
* bsc#1185842 Cross-References: * CVE-2020-36327 . # Security update for rubygem-bundler Announcement ID: SUSE-SU-2025:1294-1 Release Date: 2025-04-16T07:53:41Z Rating: important References: * bsc#1185842 Cross-References: * CVE-2020-36327 CVSS scores: * CVE-2020-36327 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2020-36327 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for rubygem-bundler fixes the following issues: * CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, which means that arogue gem found at a public source may be chosen (bsc#1185842) Other fixes: \- Updated to version 2.2.34 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1294=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1294=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-1294=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-1294=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-1294=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-1294=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-1294=1 * SUSE Linux Enterprise Server 15 SP3 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-1294=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-1294=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-1294=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-1294=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-1294=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-1294=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2025-1294=1 * SUSEManager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2025-1294=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-1294=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2025-1294=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-bundler-doc-2.2.34-150000.3.11.1 * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise Server 15 SP3 LTSS (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) *ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Manager Proxy 4.3 (x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * ruby2.5-rubygem-bundler-2.2.34-150000.3.11.1 ## References: * https://www.suse.com/security/cve/CVE-2020-36327.html * https://bugzilla.suse.com/show_bug.cgi?id=1185842 . Expedite resolution of rubygem-bundler's urgent flaw in SUSE platforms with vital upgrade guidelines.. rubygem-bundler update, SUSE Linux patch, security advisory rubygem. . Severity: Important. LinuxSecurity.com Team
Apr 16, 2025
•Important
SuSE
202
security advisorymoderateupdateopenSUSE: 2023:0350-1 Moderate: RubyGem ActiveSupport File Disclosure
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for rubygem-activesupport-5.2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0350-1 Rating: moderate References: #1214807 Cross-References: CVE-2023-38037 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-activesupport-5.2 fixes the following issue: - CVE-2023-38037: fixed a File Disclosure of Locally Encrypted Files (bsc#1214807) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-350=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): ruby2.5-rubygem-activesupport-5.2-5.2.3-bp155.3.5.1 ruby2.5-rubygem-activesupport-doc-5.2-5.2.3-bp155.3.5.1 References: https://www.suse.com/security/cve/CVE-2023-38037.html https://bugzilla.suse.com/1214807 . This patch release tackles a vulnerability related to file exposure found in rubygem-activesupport-5.2 on openSUSE Backports SLE-15-SP5.. openSUSE Security Update, rubygem-activesupport, file disclosure, SLE-15-SP5. . LinuxSecurity.com Team
Nov 04, 2023
OpenSUSE
202
security advisoryimportantXSS issueopenSUSE: 2023:3714-1 Important: Rubygem-Rails-HTML-Sanitizer XSS Fix
This update for rubygem-rails-html-sanitizer fixes the following issues: CVE-2022-23517: Fixed inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes.. # Security update for rubygem-rails-html-sanitizer Announcement ID: SUSE-SU-2023:3714-1 Rating: important References: * #1206433 * #1206434 * #1206435 * #1206436 Cross-References: * CVE-2022-23517 * CVE-2022-23518 * CVE-2022-23519 * CVE-2022-23520 CVSS scores: * CVE-2022-23517 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2022-23517 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-23518 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L * CVE-2022-23518 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2022-23518 ( NVD ): 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2022-23519 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N * CVE-2022-23519 ( NVD ): 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N * CVE-2022-23520 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2022-23520 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP1 * SUSE Linux Enterprise High Availability Extension 15 SP2 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 * SUSE Linux Enterprise Server15 SP2 * SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.0 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.0 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.0 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves four vulnerabilities can now be installed. ## Description: This update for rubygem-rails-html-sanitizer fixes the following issues: * CVE-2022-23517: Fixed inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. (bsc#1206433) * CVE-2022-23518: Fixed XSS via data URIs when used in combination with Loofah. (bsc#1206434) * CVE-2022-23519: Fixed XSS vulnerability with certain configurations of Rails::Html::Sanitizer. (bsc#1206435) * CVE-2022-23520: Fixed XSS vulnerability with certain configurations of Rails::Html::Sanitizer. (bsc#1206436) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3714=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3714=1 * SUSE Linux Enterprise High AvailabilityExtension 15 SP1 zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2023-3714=1 * SUSE Linux Enterprise High Availability Extension 15 SP2 zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2023-3714=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2023-3714=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-3714=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2023-3714=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rails-html-sanitizer-doc-1.0.4-150000.4.6.1 * ruby2.5-rubygem-rails-html-sanitizer-testsuite-1.0.4-150000.4.6.1 * ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.6.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rails-html-sanitizer-doc-1.0.4-150000.4.6.1 * ruby2.5-rubygem-rails-html-sanitizer-testsuite-1.0.4-150000.4.6.1 * ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.6.1 * SUSE Linux Enterprise High Availability Extension 15 SP1 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.6.1 * SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.6.1 * SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.6.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.6.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rails-html-sanitizer-1.0.4-150000.4.6.1 ## References: * https://www.suse.com/security/cve/CVE-2022-23517.html * https://www.suse.com/security/cve/CVE-2022-23518.html *https://www.suse.com/security/cve/CVE-2022-23519.html * https://www.suse.com/security/cve/CVE-2022-23520.html * https://bugzilla.suse.com/show_bug.cgi?id=1206433 * https://bugzilla.suse.com/show_bug.cgi?id=1206434 * https://bugzilla.suse.com/show_bug.cgi?id=1206435 * https://bugzilla.suse.com/show_bug.cgi?id=1206436 . A critical security notification has been released for openSUSE concerning the rubygem-rails-html-sanitizer, which resolves several security loopholes.. rubygem-rails-html-sanitizer, openSUSE update, XSS risk. . Severity: Important. LinuxSecurity.com Team
Sep 20, 2023
•Important
OpenSUSE
89
security advisoryFedoraXSSFedora 37 Advisory 2023-7002afbbb8 Moderate: XSS Risk in ActiveModel
Update to Ruby on Rails 7.0.4.3. https://rubyonrails.org/2023/3/13/Rails-7-0-4-3-and-6-1-7-3-have-been-released. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-7002afbbb8 2023-04-05 01:34:43.146270 --------------------------------------------------------------------------------Name : rubygem-activemodel Product : Fedora 37 Version : 7.0.4.3 Release : 1.fc37 URL : https://rubyonrails.org/ Summary : A toolkit for building modeling frameworks (part of Rails) Description : A toolkit for building modeling frameworks like Active Record. Rich support for attributes, callbacks, validations, serialization, internationalization, and testing. --------------------------------------------------------------------------------Update Information: Update to Ruby on Rails 7.0.4.3. https://rubyonrails.org/2023/3/13/Rails-7-0-4-3-and-6-1-7-3-have-been-released --------------------------------------------------------------------------------ChangeLog: * Tue Mar 14 2023 Pavel Valena - 7.0.4.3-1 - Update to activemodel 7.0.4.3. --------------------------------------------------------------------------------References: [ 1 ] Bug #2179637 - CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice https://bugzilla.redhat.com/show_bug.cgi?id=2179637 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-7002afbbb8' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Apr 05, 2023
Fedora
89
security advisoryfedoraupdateFedora 38: FEDORA-2023-d6157bb1e2 Critical: rubygem-rails XSS Patch
Update to 7.0.4.3. https://rubyonrails.org/2023/3/13/Rails-7-0-4-3-and-6-1-7-3-have-been-released. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-d6157bb1e2 2023-04-01 00:15:35.161368 --------------------------------------------------------------------------------Name : rubygem-rails Product : Fedora 38 Version : 7.0.4.3 Release : 1.fc38 URL : https://rubyonrails.org/ Summary : Full-stack web application framework Description : Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration. --------------------------------------------------------------------------------Update Information: Update to 7.0.4.3. https://rubyonrails.org/2023/3/13/Rails-7-0-4-3-and-6-1-7-3-have-been-released --------------------------------------------------------------------------------ChangeLog: * Tue Mar 14 2023 Pavel Valena - 1:7.0.4.3-1 - Update to rails 7.0.4.3. Resolves: rhbz#2032639 --------------------------------------------------------------------------------References: [ 1 ] Bug #2179637 - CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice https://bugzilla.redhat.com/show_bug.cgi?id=2179637 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-d6157bb1e2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announcemailing list --
Apr 01, 2023
•Critical
Fedora
89
security advisorymoderatesoftware updateFedora 38: 2023-d6157bb1e2 Moderate: Rubygem Activestorage XSS Threat
Update to 7.0.4.3. https://rubyonrails.org/2023/3/13/Rails-7-0-4-3-and-6-1-7-3-have-been-released. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-d6157bb1e2 2023-04-01 00:15:35.161368 --------------------------------------------------------------------------------Name : rubygem-activestorage Product : Fedora 38 Version : 7.0.4.3 Release : 1.fc38 URL : https://rubyonrails.org/ Summary : Local and cloud file storage framework Description : Attach cloud and local files in Rails applications. --------------------------------------------------------------------------------Update Information: Update to 7.0.4.3. https://rubyonrails.org/2023/3/13/Rails-7-0-4-3-and-6-1-7-3-have-been-released --------------------------------------------------------------------------------ChangeLog: * Tue Mar 14 2023 Pavel Valena - 7.0.4.3-1 - Update to activestorage 7.0.4.3. --------------------------------------------------------------------------------References: [ 1 ] Bug #2179637 - CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice https://bugzilla.redhat.com/show_bug.cgi?id=2179637 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-d6157bb1e2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Apr 01, 2023
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!