Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:0127-1

Опубликовано: 24 янв. 2023
Источник: suse-cvrf

Описание

Security update for rubygem-websocket-extensions

This update for rubygem-websocket-extensions fixes the following issues:

  • CVE-2020-7663: Fixed an excessive resource consumption when parsing crafted message headers sent by an attacker (bsc#1172445).

Список пакетов

Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-BYOS-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-BYOS-EC2-HVM
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-BYOS-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-EC2-HVM
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP3-SAP-BYOS-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP3-SAP-BYOS-EC2-HVM
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP3-SAP-BYOS-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Azure-LI-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Azure-LI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Azure-VLI-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-BYOS-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-BYOS-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-BYOS-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Hardened
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Hardened-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Hardened-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Hardened-BYOS-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Hardened-BYOS-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Hardened-BYOS-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Hardened-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP4-SAP-Hardened-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Azure-3P
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Azure-LI-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Azure-LI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Azure-VLI-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-BYOS-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-BYOS-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-BYOS-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Hardened-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Hardened-BYOS-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Hardened-BYOS-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Hardened-BYOS-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Hardened-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP5-SAP-Hardened-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Azure-LI-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Azure-LI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Azure-VLI-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-BYOS-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-BYOS-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-BYOS-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Hardened
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Hardened-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Hardened-BYOS
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Hardened-BYOS-Azure
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Hardened-BYOS-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Hardened-BYOS-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Hardened-EC2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP6-SAP-Hardened-GCE
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
SUSE Linux Enterprise High Availability Extension 15 SP1
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
SUSE Linux Enterprise High Availability Extension 15 SP2
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
SUSE Linux Enterprise High Availability Extension 15 SP3
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
SUSE Linux Enterprise High Availability Extension 15 SP4
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
openSUSE Leap 15.4
ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
ruby2.5-rubygem-websocket-extensions-doc-0.1.3-150000.3.4.1

Ссылки

Описание

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Затронутые продукты
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-websocket-extensions-0.1.3-150000.3.4.1
Ссылки
Уязвимость SUSE-SU-2023:0127-1