SUSE-SU-2022:1512-1

Details

Description of the patch:

This update for ruby2.5 fixes the following issues:

CVE-2022-28739: Fixed a buffer overrun in String-to-Float conversion (bsc#1198441).
CVE-2021-41817: Fixed a regular expression denial of service in Date Parsing Methods (bsc#1193035).
CVE-2021-32066: Fixed a StartTLS stripping vulnerability in Net:IMAP (bsc#1188160).
CVE-2021-31810: Fixed a trusting FTP PASV responses vulnerability in Net:FTP (bsc#1188161).
CVE-2021-31799: Fixed a command injection vulnerability in RDoc (bsc#1190375).

Affected Packages

libruby2_5-2_5

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

2.5.9-150000.4.23.1

ruby2.5

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

2.5.9-150000.4.23.1

ruby2.5-devel

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

2.5.9-150000.4.23.1

ruby2.5-devel-extra

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

2.5.9-150000.4.23.1

ruby2.5-stdlib

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15

Fixed in:

2.5.9-150000.4.23.1

ruby2.5-doc

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

2.5.9-150000.4.23.1

ruby2.5-doc-ri

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

2.5.9-150000.4.23.1

References

ADVISORY