Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in ruby-bundled-gems-rpmhelper
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in ruby-bundled-gems-rpmhelper
ID: SUSE-SU-2019:1804-1
Distribution: SUSE
Plattformen: SUSE Linux Enterprise Module for Basesystem 15, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1, SUSE Linux Enterprise Module for Basesystem 15-SP1
Datum: Mi, 10. Juli 2019, 16:41
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8778
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000074
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8320
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000073
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000078
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8321
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8322
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16395
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8779
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8323
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000079
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8324
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8780
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8325
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17742
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6914
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8777
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000076
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000077
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16396
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000075
Applikationen: ruby-bundled-gems-rpmhelper

Originalnachricht


SUSE Security Update: Security update for ruby-bundled-gems-rpmhelper,
ruby2.5
______________________________________________________________________________

Announcement ID: SUSE-SU-2019:1804-1
Rating: important
References: #1082007 #1082008 #1082009 #1082010 #1082011
#1082014 #1082058 #1087433 #1087434 #1087436
#1087437 #1087440 #1087441 #1112530 #1112532
#1130028 #1130611 #1130617 #1130620 #1130622
#1130623 #1130627 #1133790
Cross-References: CVE-2017-17742 CVE-2018-1000073 CVE-2018-1000074
CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077
CVE-2018-1000078 CVE-2018-1000079 CVE-2018-16395
CVE-2018-16396 CVE-2018-6914 CVE-2018-8777
CVE-2018-8778 CVE-2018-8779 CVE-2018-8780
CVE-2019-8320 CVE-2019-8321 CVE-2019-8322
CVE-2019-8323 CVE-2019-8324 CVE-2019-8325

Affected Products:
SUSE Linux Enterprise Module for Open Buildservice
Development Tools 15-SP1
SUSE Linux Enterprise Module for Open Buildservice
Development Tools 15
SUSE Linux Enterprise Module for Basesystem 15-SP1
SUSE Linux Enterprise Module for Basesystem 15
______________________________________________________________________________

An update that solves 21 vulnerabilities and has two fixes
is now available.

Description:

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the
following issues:

Changes in ruby2.5:

Update to 2.5.5 and 2.5.4:

https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/
https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/

Security issues fixed:

- CVE-2019-8320: Delete directory using symlink when decompressing tar
(bsc#1130627)
- CVE-2019-8321: Escape sequence injection vulnerability in verbose
(bsc#1130623)
- CVE-2019-8322: Escape sequence injection vulnerability in gem
owner (bsc#1130622)
- CVE-2019-8323: Escape sequence injection vulnerability in API response
handling (bsc#1130620)
- CVE-2019-8324: Installing a malicious gem may lead to arbitrary code
execution (bsc#1130617)
- CVE-2019-8325: Escape sequence injection vulnerability in errors
(bsc#1130611)


Ruby 2.5 was updated to 2.5.3:

This release includes some bug fixes and some security fixes.

Security issues fixed:

- CVE-2018-16396: Tainted flags are not propagated in Array#pack and
String#unpack with some directives (bsc#1112532)
- CVE-2018-16395: OpenSSL::X509::Name equality check does not work
correctly (bsc#1112530)

Ruby 2.5 was updated to 2.5.1:

This release includes some bug fixes and some security fixes.

Security issues fixed:

- CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434)
- CVE-2018-6914: Unintentional file and directory creation with directory
traversal in tempfile and tmpdir (bsc#1087441)
- CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436)
- CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433)
- CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
UNIXServer and UNIXSocket (bsc#1087440)
- CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in
Dir (bsc#1087437)

- Multiple vulnerabilities in RubyGems were fixed:

- CVE-2018-1000079: Fixed path traversal issue during gem installation
allows to write to arbitrary filesystem locations (bsc#1082058)
- CVE-2018-1000075: Fixed infinite loop vulnerability due to negative
size in tar header causes Denial of Service (bsc#1082014)
- CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when
displayed via gem server (bsc#1082011)
- CVE-2018-1000077: Fixed that missing URL validation on spec home
attribute allows malicious gem to set an invalid homepage URL
(bsc#1082010)
- CVE-2018-1000076: Fixed improper verification of signatures in tarball
allows to install mis-signed gem (bsc#1082009)
- CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in
gem owner allowing arbitrary code execution on specially crafted YAML
(bsc#1082008)
- CVE-2018-1000073: Fixed path traversal when writing to a symlinked
basedir outside of the root (bsc#1082007)

Other changes:

- Fixed Net::POPMail methods modify frozen literal when using default arg
- ruby: change over of the Japanese Era to the new emperor May 1st 2019
(bsc#1133790)
- build with PIE support (bsc#1130028)


Changes in ruby-bundled-gems-rpmhelper:

- Add a new helper for bundled ruby gems.


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Module for Open Buildservice Development Tools
15-SP1:

zypper in -t patch
SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1804=1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:

zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2019-1804=1

- SUSE Linux Enterprise Module for Basesystem 15-SP1:

zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2019-1804=1

- SUSE Linux Enterprise Module for Basesystem 15:

zypper in -t patch SUSE-SLE-Module-Basesystem-15-2019-1804=1



Package List:

- SUSE Linux Enterprise Module for Open Buildservice Development Tools
15-SP1 (aarch64 ppc64le s390x x86_64):

ruby2.5-debuginfo-2.5.5-4.3.1
ruby2.5-debugsource-2.5.5-4.3.1
ruby2.5-doc-2.5.5-4.3.1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools
15-SP1 (noarch):

ruby2.5-doc-ri-2.5.5-4.3.1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
(aarch64 ppc64le s390x x86_64):

ruby2.5-debuginfo-2.5.5-4.3.1
ruby2.5-debugsource-2.5.5-4.3.1
ruby2.5-doc-2.5.5-4.3.1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
(noarch):

ruby2.5-doc-ri-2.5.5-4.3.1

- SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x
x86_64):

libruby2_5-2_5-2.5.5-4.3.1
libruby2_5-2_5-debuginfo-2.5.5-4.3.1
ruby2.5-2.5.5-4.3.1
ruby2.5-debuginfo-2.5.5-4.3.1
ruby2.5-debugsource-2.5.5-4.3.1
ruby2.5-devel-2.5.5-4.3.1
ruby2.5-devel-extra-2.5.5-4.3.1
ruby2.5-stdlib-2.5.5-4.3.1
ruby2.5-stdlib-debuginfo-2.5.5-4.3.1

- SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x
x86_64):

libruby2_5-2_5-2.5.5-4.3.1
libruby2_5-2_5-debuginfo-2.5.5-4.3.1
ruby2.5-2.5.5-4.3.1
ruby2.5-debuginfo-2.5.5-4.3.1
ruby2.5-debugsource-2.5.5-4.3.1
ruby2.5-devel-2.5.5-4.3.1
ruby2.5-devel-extra-2.5.5-4.3.1
ruby2.5-stdlib-2.5.5-4.3.1
ruby2.5-stdlib-debuginfo-2.5.5-4.3.1


References:

https://www.suse.com/security/cve/CVE-2017-17742.html
https://www.suse.com/security/cve/CVE-2018-1000073.html
https://www.suse.com/security/cve/CVE-2018-1000074.html
https://www.suse.com/security/cve/CVE-2018-1000075.html
https://www.suse.com/security/cve/CVE-2018-1000076.html
https://www.suse.com/security/cve/CVE-2018-1000077.html
https://www.suse.com/security/cve/CVE-2018-1000078.html
https://www.suse.com/security/cve/CVE-2018-1000079.html
https://www.suse.com/security/cve/CVE-2018-16395.html
https://www.suse.com/security/cve/CVE-2018-16396.html
https://www.suse.com/security/cve/CVE-2018-6914.html
https://www.suse.com/security/cve/CVE-2018-8777.html
https://www.suse.com/security/cve/CVE-2018-8778.html
https://www.suse.com/security/cve/CVE-2018-8779.html
https://www.suse.com/security/cve/CVE-2018-8780.html
https://www.suse.com/security/cve/CVE-2019-8320.html
https://www.suse.com/security/cve/CVE-2019-8321.html
https://www.suse.com/security/cve/CVE-2019-8322.html
https://www.suse.com/security/cve/CVE-2019-8323.html
https://www.suse.com/security/cve/CVE-2019-8324.html
https://www.suse.com/security/cve/CVE-2019-8325.html
https://bugzilla.suse.com/1082007
https://bugzilla.suse.com/1082008
https://bugzilla.suse.com/1082009
https://bugzilla.suse.com/1082010
https://bugzilla.suse.com/1082011
https://bugzilla.suse.com/1082014
https://bugzilla.suse.com/1082058
https://bugzilla.suse.com/1087433
https://bugzilla.suse.com/1087434
https://bugzilla.suse.com/1087436
https://bugzilla.suse.com/1087437
https://bugzilla.suse.com/1087440
https://bugzilla.suse.com/1087441
https://bugzilla.suse.com/1112530
https://bugzilla.suse.com/1112532
https://bugzilla.suse.com/1130028
https://bugzilla.suse.com/1130611
https://bugzilla.suse.com/1130617
https://bugzilla.suse.com/1130620
https://bugzilla.suse.com/1130622
https://bugzilla.suse.com/1130623
https://bugzilla.suse.com/1130627
https://bugzilla.suse.com/1133790

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung