Vulnerability   
Search   
    Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.1.4.2019.1804.1
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory (SUSE-SU-2019:1804-1)
Summary:The remote host is missing an update for the 'ruby-bundled-gems-rpmhelper, ruby2.5' package(s) announced via the SUSE-SU-2019:1804-1 advisory.
Description:Summary:
The remote host is missing an update for the 'ruby-bundled-gems-rpmhelper, ruby2.5' package(s) announced via the SUSE-SU-2019:1804-1 advisory.

Vulnerability Insight:
This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues:

Changes in ruby2.5:

Update to 2.5.5 and 2.5.4:

[link moved to references]
[link moved to references]

Security issues fixed:
CVE-2019-8320: Delete directory using symlink when decompressing tar
(bsc#1130627)

CVE-2019-8321: Escape sequence injection vulnerability in verbose
(bsc#1130623)

CVE-2019-8322: Escape sequence injection vulnerability in gem
owner (bsc#1130622)

CVE-2019-8323: Escape sequence injection vulnerability in API response
handling (bsc#1130620)

CVE-2019-8324: Installing a malicious gem may lead to arbitrary code
execution (bsc#1130617)

CVE-2019-8325: Escape sequence injection vulnerability in errors
(bsc#1130611)


Ruby 2.5 was updated to 2.5.3:

This release includes some bug fixes and some security fixes.

Security issues fixed:
CVE-2018-16396: Tainted flags are not propagated in Array#pack and
String#unpack with some directives (bsc#1112532)

CVE-2018-16395: OpenSSL::X509::Name equality check does not work
correctly (bsc#1112530)

Ruby 2.5 was updated to 2.5.1:

This release includes some bug fixes and some security fixes.

Security issues fixed:
CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434)

CVE-2018-6914: Unintentional file and directory creation with directory
traversal in tempfile and tmpdir (bsc#1087441)

CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436)

CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433)

CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
UNIXServer and UNIXSocket (bsc#1087440)

CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in
Dir (bsc#1087437)
Multiple vulnerabilities in RubyGems were fixed:

- CVE-2018-1000079: Fixed path traversal issue during gem installation
allows to write to arbitrary filesystem locations (bsc#1082058)
- CVE-2018-1000075: Fixed infinite loop vulnerability due to negative
size in tar header causes Denial of Service (bsc#1082014)
- CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when
displayed via gem server (bsc#1082011)
- CVE-2018-1000077: Fixed that missing URL validation on spec home
attribute allows malicious gem to set an invalid homepage URL
(bsc#1082010)
- CVE-2018-1000076: Fixed improper verification of signatures in tarball
allows to install mis-signed gem (bsc#1082009)
- CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in
gem owner allowing arbitrary code execution on specially crafted YAML
(bsc#1082008)
- CVE-2018-1000073: Fixed path traversal when writing to a symlinked
basedir outside of the root (bsc#1082007)

Other changes:
Fixed Net::POPMail methods modify frozen literal when using default arg

ruby: change over of the Japanese Era to the new emperor May 1st 2019
(bsc#1133790)

buil... [Please see the references for more information on the vulnerabilities]

Affected Software/OS:
'ruby-bundled-gems-rpmhelper, ruby2.5' package(s) on SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Module for Basesystem 15-SP1, SUSE Linux Enterprise Module for Basesystem 15

Solution:
Please install the updated package(s).

CVSS Score:
8.8

CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2018-6914
BugTraq ID: 103686
http://www.securityfocus.com/bid/103686
Debian Security Information: DSA-4259 (Google Search)
https://www.debian.org/security/2018/dsa-4259
https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
RedHat Security Advisories: RHSA-2018:3729
https://access.redhat.com/errata/RHSA-2018:3729
RedHat Security Advisories: RHSA-2018:3730
https://access.redhat.com/errata/RHSA-2018:3730
RedHat Security Advisories: RHSA-2018:3731
https://access.redhat.com/errata/RHSA-2018:3731
RedHat Security Advisories: RHSA-2019:2028
https://access.redhat.com/errata/RHSA-2019:2028
http://www.securitytracker.com/id/1042004
SuSE Security Announcement: openSUSE-SU-2019:1771 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
https://usn.ubuntu.com/3626-1/
Common Vulnerability Exposure (CVE) ID: CVE-2018-8777
BugTraq ID: 103683
http://www.securityfocus.com/bid/103683
RedHat Security Advisories: RHSA-2020:0542
https://access.redhat.com/errata/RHSA-2020:0542
RedHat Security Advisories: RHSA-2020:0591
https://access.redhat.com/errata/RHSA-2020:0591
RedHat Security Advisories: RHSA-2020:0663
https://access.redhat.com/errata/RHSA-2020:0663
https://usn.ubuntu.com/3685-1/
Common Vulnerability Exposure (CVE) ID: CVE-2018-8778
BugTraq ID: 103693
http://www.securityfocus.com/bid/103693
Common Vulnerability Exposure (CVE) ID: CVE-2018-8779
BugTraq ID: 103767
http://www.securityfocus.com/bid/103767
Common Vulnerability Exposure (CVE) ID: CVE-2018-8780
BugTraq ID: 103739
http://www.securityfocus.com/bid/103739
Common Vulnerability Exposure (CVE) ID: CVE-2019-8320
https://hackerone.com/reports/317321
https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
RedHat Security Advisories: RHSA-2019:1429
https://access.redhat.com/errata/RHSA-2019:1429
Common Vulnerability Exposure (CVE) ID: CVE-2019-8321
https://hackerone.com/reports/317330
Common Vulnerability Exposure (CVE) ID: CVE-2019-8322
https://hackerone.com/reports/315087
Common Vulnerability Exposure (CVE) ID: CVE-2019-8323
https://hackerone.com/reports/315081
Common Vulnerability Exposure (CVE) ID: CVE-2019-8324
https://hackerone.com/reports/328571
RedHat Security Advisories: RHSA-2019:1972
https://access.redhat.com/errata/RHSA-2019:1972
Common Vulnerability Exposure (CVE) ID: CVE-2019-8325
https://hackerone.com/reports/317353
CopyrightCopyright (C) 2021 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.