Описание
Security update for rubygem-actionpack-3_2
This update for rubygem-actionpack-3_2 fixes the following issues:
- CVE-2016-0751: Object Leak DoS (bsc#963331)
- CVE-2016-0752: Directory traversal and information leak in Action View (bsc#963332)
- CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)
Список пакетов
SUSE Lifecycle Management Server 1.3
SUSE Linux Enterprise Software Development Kit 11 SP4
SUSE Studio Onsite 1.3
SUSE WebYast 1.3
Ссылки
- Link for SUSE-SU-2016:0618-1
- E-Mail link for SUSE-SU-2016:0618-1
- SUSE Security Ratings
- SUSE Bug 963329
- SUSE Bug 963331
- SUSE Bug 963332
- SUSE CVE CVE-2015-7576 page
- SUSE CVE CVE-2016-0751 page
- SUSE CVE CVE-2016-0752 page
Описание
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Затронутые продукты
Ссылки
- CVE-2015-7576
- SUSE Bug 963329
- SUSE Bug 963563
- SUSE Bug 970715
Описание
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
Затронутые продукты
Ссылки
- CVE-2016-0751
- SUSE Bug 963331
- SUSE Bug 963627
Описание
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Затронутые продукты
Ссылки
- CVE-2016-0752
- SUSE Bug 963332
- SUSE Bug 963608
- SUSE Bug 968850