Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2023:0350-1

Опубликовано: 03 нояб. 2023
Источник: suse-cvrf

Описание

Security update for rubygem-activesupport-5.2

This update for rubygem-activesupport-5.2 fixes the following issue:

  • CVE-2023-38037: fixed a File Disclosure of Locally Encrypted Files (bsc#1214807)

Список пакетов

SUSE Package Hub 15 SP5
ruby2.5-rubygem-activesupport-5.2-5.2.3-bp155.3.5.1
ruby2.5-rubygem-activesupport-doc-5.2-5.2.3-bp155.3.5.1
openSUSE Leap 15.5
ruby2.5-rubygem-activesupport-5.2-5.2.3-bp155.3.5.1
ruby2.5-rubygem-activesupport-doc-5.2-5.2.3-bp155.3.5.1

Ссылки

Описание

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current `umask` settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it. All users running an affected release should either upgrade or use one of the workarounds immediately.

Затронутые продукты
SUSE Package Hub 15 SP5:ruby2.5-rubygem-activesupport-5.2-5.2.3-bp155.3.5.1
SUSE Package Hub 15 SP5:ruby2.5-rubygem-activesupport-doc-5.2-5.2.3-bp155.3.5.1
openSUSE Leap 15.5:ruby2.5-rubygem-activesupport-5.2-5.2.3-bp155.3.5.1
openSUSE Leap 15.5:ruby2.5-rubygem-activesupport-doc-5.2-5.2.3-bp155.3.5.1
Ссылки