1. Home
  2. Security Advisories
  3. SUSE
  4. SUSE-SU-2019:1804-1

[SUSE-SU-2019:1804-1] Security update for ruby-bundled-gems-rpmhelper, ruby2.5

Severity Important
CVEs 21
Info References Vulnerabilities

Security update for ruby-bundled-gems-rpmhelper, ruby2.5

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues:

Changes in ruby2.5:

Update to 2.5.5 and 2.5.4:

https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/
https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/

Security issues fixed:

  • CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627)
  • CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623)
  • CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622)
  • CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620)
  • CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617)
  • CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611)

Ruby 2.5 was updated to 2.5.3:

This release includes some bug fixes and some security fixes.

Security issues fixed:

  • CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532)
  • CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530)

Ruby 2.5 was updated to 2.5.1:

This release includes some bug fixes and some security fixes.

Security issues fixed:

  • CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434)
  • CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441)
  • CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436)
  • CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433)
  • CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440)

  • CVE-2018-8780: Unintentional directory traversal by poisoned
    NUL byte in Dir (bsc#1087437)

  • Multiple vulnerabilities in RubyGems were fixed:

    • CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058)
    • CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014)
    • CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011)
    • CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010)
    • CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009)
    • CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008)
    • CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007)

Other changes:

  • Fixed Net::POPMail methods modify frozen literal when using default arg
  • ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790)
  • build with PIE support (bsc#1130028)

Changes in ruby-bundled-gems-rpmhelper:

  • Add a new helper for bundled ruby gems.
ID
SUSE-SU-2019:1804-1
Severity
important
URL
https://www.suse.com/support/update/announcement/2019/suse-su-20191804-1/
Published
2019-07-10T08:40:49
(5 years ago)
Modified
2019-07-10T08:40:49
(5 years ago)
Rights
Copyright 2024 SUSE LLC. All rights reserved.
Other Advisories
Source # ID Name URL
Suse SUSE ratings https://www.suse.com/support/security/rating/
Suse URL of this CSAF notice https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1804-1.json
Suse URL for SUSE-SU-2019:1804-1 https://www.suse.com/support/update/announcement/2019/suse-su-20191804-1/
Suse E-Mail link for SUSE-SU-2019:1804-1 https://lists.suse.com/pipermail/sle-security-updates/2019-July/005684.html
Bugzilla SUSE Bug 1082007 https://bugzilla.suse.com/1082007
Bugzilla SUSE Bug 1082008 https://bugzilla.suse.com/1082008
Bugzilla SUSE Bug 1082009 https://bugzilla.suse.com/1082009
Bugzilla SUSE Bug 1082010 https://bugzilla.suse.com/1082010
Bugzilla SUSE Bug 1082011 https://bugzilla.suse.com/1082011
Bugzilla SUSE Bug 1082014 https://bugzilla.suse.com/1082014
Bugzilla SUSE Bug 1082058 https://bugzilla.suse.com/1082058
Bugzilla SUSE Bug 1087433 https://bugzilla.suse.com/1087433
Bugzilla SUSE Bug 1087434 https://bugzilla.suse.com/1087434
Bugzilla SUSE Bug 1087436 https://bugzilla.suse.com/1087436
Bugzilla SUSE Bug 1087437 https://bugzilla.suse.com/1087437
Bugzilla SUSE Bug 1087440 https://bugzilla.suse.com/1087440
Bugzilla SUSE Bug 1087441 https://bugzilla.suse.com/1087441
Bugzilla SUSE Bug 1112530 https://bugzilla.suse.com/1112530
Bugzilla SUSE Bug 1112532 https://bugzilla.suse.com/1112532
Bugzilla SUSE Bug 1130028 https://bugzilla.suse.com/1130028
Bugzilla SUSE Bug 1130611 https://bugzilla.suse.com/1130611
Bugzilla SUSE Bug 1130617 https://bugzilla.suse.com/1130617
Bugzilla SUSE Bug 1130620 https://bugzilla.suse.com/1130620
Bugzilla SUSE Bug 1130622 https://bugzilla.suse.com/1130622
Bugzilla SUSE Bug 1130623 https://bugzilla.suse.com/1130623
Bugzilla SUSE Bug 1130627 https://bugzilla.suse.com/1130627
Bugzilla SUSE Bug 1133790 https://bugzilla.suse.com/1133790
CVE SUSE CVE CVE-2017-17742 page https://www.suse.com/security/cve/CVE-2017-17742/
CVE SUSE CVE CVE-2018-1000073 page https://www.suse.com/security/cve/CVE-2018-1000073/
CVE SUSE CVE CVE-2018-1000074 page https://www.suse.com/security/cve/CVE-2018-1000074/
CVE SUSE CVE CVE-2018-1000075 page https://www.suse.com/security/cve/CVE-2018-1000075/
CVE SUSE CVE CVE-2018-1000076 page https://www.suse.com/security/cve/CVE-2018-1000076/
CVE SUSE CVE CVE-2018-1000077 page https://www.suse.com/security/cve/CVE-2018-1000077/
CVE SUSE CVE CVE-2018-1000078 page https://www.suse.com/security/cve/CVE-2018-1000078/
CVE SUSE CVE CVE-2018-1000079 page https://www.suse.com/security/cve/CVE-2018-1000079/
CVE SUSE CVE CVE-2018-16395 page https://www.suse.com/security/cve/CVE-2018-16395/
CVE SUSE CVE CVE-2018-16396 page https://www.suse.com/security/cve/CVE-2018-16396/
CVE SUSE CVE CVE-2018-6914 page https://www.suse.com/security/cve/CVE-2018-6914/
CVE SUSE CVE CVE-2018-8777 page https://www.suse.com/security/cve/CVE-2018-8777/
CVE SUSE CVE CVE-2018-8778 page https://www.suse.com/security/cve/CVE-2018-8778/
CVE SUSE CVE CVE-2018-8779 page https://www.suse.com/security/cve/CVE-2018-8779/
CVE SUSE CVE CVE-2018-8780 page https://www.suse.com/security/cve/CVE-2018-8780/
CVE SUSE CVE CVE-2019-8320 page https://www.suse.com/security/cve/CVE-2019-8320/
CVE SUSE CVE CVE-2019-8321 page https://www.suse.com/security/cve/CVE-2019-8321/
CVE SUSE CVE CVE-2019-8322 page https://www.suse.com/security/cve/CVE-2019-8322/
CVE SUSE CVE CVE-2019-8323 page https://www.suse.com/security/cve/CVE-2019-8323/
CVE SUSE CVE CVE-2019-8324 page https://www.suse.com/security/cve/CVE-2019-8324/
CVE SUSE CVE CVE-2019-8325 page https://www.suse.com/security/cve/CVE-2019-8325/
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date