SUSE-SU-2024:3877-1

Опубликовано: 01 нояб. 2024

Источник: suse-cvrf

Описание

Security update for rubygem-actionpack-5_1

This update for rubygem-actionpack-5_1 fixes the following issues:

CVE-2024-47887: Fixed Possible ReDoS vulnerability in HTTP Token authentication in Action Controller (bsc#1231729).
CVE-2024-42228: Fixed uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).

Список пакетов

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-BYOS-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-BYOS-EC2-HVM

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-BYOS-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Azure-LI-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Azure-LI-BYOS-Production

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Azure-VLI-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-BYOS-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-BYOS-EC2

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-BYOS-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Hardened

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Hardened-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Hardened-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Hardened-BYOS-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Hardened-BYOS-EC2

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Hardened-BYOS-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP4-SAP-Hardened-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Azure-3P

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Azure-LI-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Azure-LI-BYOS-Production

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Azure-VLI-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-BYOS-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-BYOS-EC2

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-BYOS-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Hardened-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Hardened-BYOS-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Hardened-BYOS-EC2

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Hardened-BYOS-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP5-SAP-Hardened-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Azure-LI-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Azure-LI-BYOS-Production

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Azure-VLI-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-BYOS-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-BYOS-EC2

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-BYOS-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Hardened

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Hardened-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Hardened-BYOS

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Hardened-BYOS-Azure

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Hardened-BYOS-EC2

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Hardened-BYOS-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Hardened-EC2

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP6-SAP-Hardened-GCE

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

SUSE Linux Enterprise High Availability Extension 15 SP3

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

SUSE Linux Enterprise High Availability Extension 15 SP4

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

SUSE Linux Enterprise High Availability Extension 15 SP5

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

SUSE Linux Enterprise High Availability Extension 15 SP6

ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Ссылки

https://www.suse.com/support/update/announcement/2024/suse-su-20243877-1/
Link for SUSE-SU-2024:3877-1
https://lists.suse.com/pipermail/sle-security-updates/2024-November/019753.html
E-Mail link for SUSE-SU-2024:3877-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1228667
SUSE Bug 1228667
https://bugzilla.suse.com/1231729
SUSE Bug 1231729
https://www.suse.com/security/cve/CVE-2024-42228/
SUSE CVE CVE-2024-42228 page
https://www.suse.com/security/cve/CVE-2024-47887/
SUSE CVE CVE-2024-47887 page

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian)

Затронутые продукты

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-BYOS-Azure:ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-BYOS-EC2-HVM:ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Ссылки

https://www.suse.com/security/cve/CVE-2024-42228.html
CVE-2024-42228
https://bugzilla.suse.com/1228667
SUSE Bug 1228667

Описание

Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may choose to use Ruby 3.2 as a workaround.Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Затронутые продукты

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-BYOS-Azure:ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Image SLES15-SP3-SAP-BYOS-EC2-HVM:ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.32.1

Ссылки

https://www.suse.com/security/cve/CVE-2024-47887.html
CVE-2024-47887
https://bugzilla.suse.com/1231729
SUSE Bug 1231729

SUSE-SU-2024:3877-1

Описание

Список пакетов

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP3-SAP-BYOS-Azure

Image SLES15-SP3-SAP-BYOS-EC2-HVM

Image SLES15-SP3-SAP-BYOS-GCE

Image SLES15-SP4-SAP-Azure-LI-BYOS

Image SLES15-SP4-SAP-Azure-LI-BYOS-Production

Image SLES15-SP4-SAP-Azure-VLI-BYOS

Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP4-SAP-BYOS

Image SLES15-SP4-SAP-BYOS-Azure

Image SLES15-SP4-SAP-BYOS-EC2

Image SLES15-SP4-SAP-BYOS-GCE

Image SLES15-SP4-SAP-Hardened

Image SLES15-SP4-SAP-Hardened-Azure

Image SLES15-SP4-SAP-Hardened-BYOS

Image SLES15-SP4-SAP-Hardened-BYOS-Azure

Image SLES15-SP4-SAP-Hardened-BYOS-EC2

Image SLES15-SP4-SAP-Hardened-BYOS-GCE

Image SLES15-SP4-SAP-Hardened-GCE

Image SLES15-SP5-SAP-Azure-3P

Image SLES15-SP5-SAP-Azure-LI-BYOS

Image SLES15-SP5-SAP-Azure-LI-BYOS-Production

Image SLES15-SP5-SAP-Azure-VLI-BYOS

Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP5-SAP-BYOS-Azure

Image SLES15-SP5-SAP-BYOS-EC2

Image SLES15-SP5-SAP-BYOS-GCE

Image SLES15-SP5-SAP-Hardened-Azure

Image SLES15-SP5-SAP-Hardened-BYOS-Azure

Image SLES15-SP5-SAP-Hardened-BYOS-EC2

Image SLES15-SP5-SAP-Hardened-BYOS-GCE

Image SLES15-SP5-SAP-Hardened-GCE

Image SLES15-SP6-SAP-Azure-LI-BYOS

Image SLES15-SP6-SAP-Azure-LI-BYOS-Production

Image SLES15-SP6-SAP-Azure-VLI-BYOS

Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP6-SAP-BYOS

Image SLES15-SP6-SAP-BYOS-Azure

Image SLES15-SP6-SAP-BYOS-EC2

Image SLES15-SP6-SAP-BYOS-GCE

Image SLES15-SP6-SAP-Hardened

Image SLES15-SP6-SAP-Hardened-Azure

Image SLES15-SP6-SAP-Hardened-BYOS

Image SLES15-SP6-SAP-Hardened-BYOS-Azure

Image SLES15-SP6-SAP-Hardened-BYOS-EC2

Image SLES15-SP6-SAP-Hardened-BYOS-GCE

Image SLES15-SP6-SAP-Hardened-EC2

Image SLES15-SP6-SAP-Hardened-GCE

SUSE Linux Enterprise High Availability Extension 15 SP3

SUSE Linux Enterprise High Availability Extension 15 SP4

SUSE Linux Enterprise High Availability Extension 15 SP5

SUSE Linux Enterprise High Availability Extension 15 SP6

Ссылки

Уязвимость: CVE-2024-42228

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2024-47887

Описание

Затронутые продукты

Ссылки