Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2016:1146-1

Опубликовано: 25 апр. 2016
Источник: suse-cvrf

Описание

Security update for portus

Portus was updated to version 2.0.3, which brings several fixes and enhancements:

  • Fixed crono job when a repository could not be found.
  • Fixed compatibility issues with Docker 1.10 and Distribution 2.3.
  • Handle multiple scopes in token requests.
  • Add optional fields to token response.
  • Fixed notification events for Distribution v2.3.
  • Paginate through the catalog properly.
  • Do not remove all the repositories if fetching one fails.
  • Fixed SMTP setup.
  • Don't let crono overflow the 'log' column on the DB.
  • Show the actual LDAP error on invalid login.
  • Fixed the location of crono logs.
  • Always use relative paths.
  • Set RUBYLIB when using portusctl.
  • Don't count hidden teams on the admin panel.
  • Warn developers on unsupported docker-compose versions.
  • Directly invalidate LDAP logins without name and password.
  • Don't show the 'I forgot my password' link on LDAP.

The following Rubygems bundled within Portus have been updated to fix security issues:

  • CVE-2016-2098: rubygem-actionpack (bsc#969943).
  • CVE-2015-7578: rails-html-sanitizer (bsc#963326).
  • CVE-2015-7579: rails-html-sanitizer (bsc#963327).
  • CVE-2015-7580: rails-html-sanitizer (bsc#963328).
  • CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).
  • CVE-2015-7577: rubygem-activerecord (bsc#963604).
  • CVE-2016-0751: rugygem-actionpack (bsc#963627).
  • CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).
  • CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).
  • CVE-2015-7581: rubygem-actionpack (bsc#963625).

Список пакетов

SUSE Linux Enterprise Module for Containers 12
portus-2.0.3-2.4

Ссылки

Описание

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки

Описание

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4
Ссылки