Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Step:15
patchinfo.11712
_patchinfo
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _patchinfo of Package patchinfo.11712
<patchinfo incident="11712"> <issue tracker="bnc" id="1082008">VUL-1: CVE-2018-1000074: ruby,rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML</issue> <issue tracker="bnc" id="1082009">VUL-1: CVE-2018-1000076: ruby,rubygems: Improper verification of signatures in tarball allows to install mis-signed gem</issue> <issue tracker="bnc" id="1082007">VUL-1: CVE-2018-1000073: ruby,rubygems: Path traversal when writing to a symlinked basedir outside of the root</issue> <issue tracker="bnc" id="1130028">/usr/bin/ruby.ruby2.6 is not a PIE executable</issue> <issue tracker="bnc" id="1130627">VUL-0: CVE-2019-8320: rubygems,ruby19,ruby2.1: rubygems: Delete directory using symlink when decompressing tar</issue> <issue tracker="bnc" id="1130622">VUL-0: CVE-2019-8322: rubygems,ruby19,ruby2.1: rubygems: Escape sequence injection vulnerability in gem owner</issue> <issue tracker="bnc" id="1130623">VUL-0: CVE-2019-8321: rubygems,ruby19,ruby2.1: rubygems: Escape sequence injection vulnerability in verbose</issue> <issue tracker="bnc" id="1130620">VUL-0: CVE-2019-8323: rubygems,ruby19,ruby2.1: rubygems: Escape sequence injection vulnerability in API response handling</issue> <issue tracker="bnc" id="1087436">VUL-1: CVE-2018-8777: ruby19,ruby,ruby2.1: DoS by large request in WEBrick</issue> <issue tracker="bnc" id="1087437">VUL-1: CVE-2018-8780: ruby19,ruby,ruby2.1: Unintentional directory traversal by poisoned NUL byte in Dir</issue> <issue tracker="bnc" id="1087434">VUL-1: CVE-2017-17742: ruby19,ruby,ruby2.1: HTTP response splitting in WEBrick</issue> <issue tracker="bnc" id="1087433">VUL-1: CVE-2018-8778: ruby19,ruby,ruby2.1: Buffer under-read in String#unpack</issue> <issue tracker="bnc" id="1133790">ruby: change over of the Japanese Era to the new emperor May 1st 2019</issue> <issue tracker="bnc" id="1082058">VUL-0: CVE-2018-1000079: ruby2.1: Path traversal issue during gem installation allows to write to arbitrary filesystem locations</issue> <issue tracker="bnc" id="1112532">VUL-0: CVE-2018-16396: ruby,ruby2.1: Tainted flags are not propagated in Array#pack and String#unpack with some directives</issue> <issue tracker="bnc" id="1112530">VUL-0: CVE-2018-16395: ruby19,ruby,ruby2.1: OpenSSL::X509::Name equality check does not work correctly</issue> <issue tracker="bnc" id="1082014">VUL-1: CVE-2018-1000075: ruby,rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service</issue> <issue tracker="bnc" id="1082011">VUL-0: CVE-2018-1000078: ruby,rubygems: XSS vulnerability in homepage attribute when displayed via gem server</issue> <issue tracker="bnc" id="1082010">VUL-1: CVE-2018-1000077: ruby,rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL</issue> <issue tracker="bnc" id="1130617">VUL-0: CVE-2019-8324: rubygems,ruby2.1: rubygems: Installing a malicious gem may lead to arbitrary code execution</issue> <issue tracker="bnc" id="1130611">VUL-0: CVE-2019-8325: rubygems,ruby,ruby2.1: rubygems: Escape sequence injection vulnerability in errors</issue> <issue tracker="bnc" id="1087441">VUL-1: CVE-2018-6914: ruby19,ruby,ruby2.1: Unintentional file and directory creation with directory traversal in tempfile and tmpdir</issue> <issue tracker="bnc" id="1087440">VUL-1: CVE-2018-8779: ruby19,ruby,ruby2.1: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket</issue> <issue tracker="cve" id="2019-8321"/> <issue tracker="cve" id="2019-8320"/> <issue tracker="cve" id="2019-8323"/> <issue tracker="cve" id="2019-8322"/> <issue tracker="cve" id="2019-8325"/> <issue tracker="cve" id="2019-8324"/> <issue tracker="cve" id="2018-1000078"/> <issue tracker="cve" id="2018-1000079"/> <issue tracker="cve" id="2018-1000076"/> <issue tracker="cve" id="2018-1000077"/> <issue tracker="cve" id="2018-1000074"/> <issue tracker="cve" id="2018-1000075"/> <issue tracker="cve" id="2018-16396"/> <issue tracker="cve" id="2018-16395"/> <issue tracker="cve" id="2018-6914"/> <issue tracker="cve" id="2018-8777"/> <issue tracker="cve" id="2018-8780"/> <issue tracker="cve" id="2017-17742"/> <issue tracker="cve" id="2018-8779"/> <issue tracker="cve" id="2018-8778"/> <issue tracker="cve" id="2018-1000073"/> <category>security</category> <rating>important</rating> <packager>darix</packager> <description>This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues: Changes in ruby2.5: Update to 2.5.5 and 2.5.4: https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed: - CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627) - CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623) - CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622) - CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620) - CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617) - CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611) Ruby 2.5 was updated to 2.5.3: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532) - CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530) Ruby 2.5 was updated to 2.5.1: This release includes some bug fixes and some security fixes. Security issues fixed: - CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434) - CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441) - CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436) - CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433) - CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440) - CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437) - Multiple vulnerabilities in RubyGems were fixed: - CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058) - CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014) - CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011) - CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010) - CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009) - CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008) - CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007) Other changes: - Fixed Net::POPMail methods modify frozen literal when using default arg - ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790) - build with PIE support (bsc#1130028) Changes in ruby-bundled-gems-rpmhelper: - Add a new helper for bundled ruby gems. </description> <summary>Security update for ruby-bundled-gems-rpmhelper, ruby2.5</summary> </patchinfo>
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor