Security update for rubygem-activesupport-4_1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0082-1 Final 1 1 2016-01-12T10:24:18Z current 2016-01-12T10:24:18Z 2016-01-12T10:24:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-activesupport-4_1 This update fixes the following security issues: - CVE-2015-3227: Possible Denial of Service attack in Active Support (bnc#934800) - CVE-2015-3226: XSS Vulnerability in ActiveSupport::JSON (bnc#934799) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleclo50sp3-rubygem-activesupport-4_1-12314 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160082-1/ Link for SUSE-SU-2016:0082-1 https://lists.suse.com/pipermail/sle-security-updates/2016-January/001792.html E-Mail link for SUSE-SU-2016:0082-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/934799 SUSE Bug 934799 https://bugzilla.suse.com/934800 SUSE Bug 934800 https://www.suse.com/security/cve/CVE-2015-3226/ SUSE CVE CVE-2015-3226 page https://www.suse.com/security/cve/CVE-2015-3227/ SUSE CVE CVE-2015-3227 page SUSE OpenStack Cloud 5 ruby2.1-rubygem-activesupport-4_1-4.1.9-9.2 ruby2.1-rubygem-activesupport-4_1-4.1.9-9.2 as a component of SUSE OpenStack Cloud 5 Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding. CVE-2015-3226 SUSE OpenStack Cloud 5:ruby2.1-rubygem-activesupport-4_1-4.1.9-9.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160082-1/ https://www.suse.com/security/cve/CVE-2015-3226.html CVE-2015-3226 https://bugzilla.suse.com/934799 SUSE Bug 934799 The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth. CVE-2015-3227 SUSE OpenStack Cloud 5:ruby2.1-rubygem-activesupport-4_1-4.1.9-9.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160082-1/ https://www.suse.com/security/cve/CVE-2015-3227.html CVE-2015-3227 https://bugzilla.suse.com/934800 SUSE Bug 934800