SUSE-SU-2022:2592-1

Details

This update for rubygem-tzinfo fixes the following issues:

CVE-2022-31163: Fixed relative path traversal vulnerability that allows TZInfo::Timezone.get to load arbitrary files (bsc#1201835).

Affected Packages

ruby2.5-rubygem-tzinfo

SUSE Linux Enterprise High Availability Extension 15SUSE Linux Enterprise High Availability Extension 15 SP1SUSE Linux Enterprise High Availability Extension 15 SP2SUSE Linux Enterprise High Availability Extension 15 SP3SUSE Linux Enterprise High Availability Extension 15 SP4

Fixed in:

1.2.4-150000.3.3.1

rubygem-tzinfo

SUSE Linux Enterprise High Availability Extension 15SUSE Linux Enterprise High Availability Extension 15 SP1SUSE Linux Enterprise High Availability Extension 15 SP2SUSE Linux Enterprise High Availability Extension 15 SP3SUSE Linux Enterprise High Availability Extension 15 SP4

Fixed in:

1.2.4-150000.3.3.1

ruby2.5-rubygem-tzinfo-doc

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

1.2.4-150000.3.3.1

ruby2.5-rubygem-tzinfo-testsuite

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

1.2.4-150000.3.3.1

References

REPORT

https://bugzilla.suse.com/1201835

WEB

https://www.suse.com/security/cve/CVE-2022-31163

ADVISORY

https://www.suse.com/support/update/announcement/2022/suse-su-20222592-1/