Security update for portus SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1146-1 Final 1 1 2016-04-25T14:28:51Z current 2016-04-25T14:28:51Z 2016-04-25T14:28:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for portus Portus was updated to version 2.0.3, which brings several fixes and enhancements: - Fixed crono job when a repository could not be found. - Fixed compatibility issues with Docker 1.10 and Distribution 2.3. - Handle multiple scopes in token requests. - Add optional fields to token response. - Fixed notification events for Distribution v2.3. - Paginate through the catalog properly. - Do not remove all the repositories if fetching one fails. - Fixed SMTP setup. - Don't let crono overflow the 'log' column on the DB. - Show the actual LDAP error on invalid login. - Fixed the location of crono logs. - Always use relative paths. - Set RUBYLIB when using portusctl. - Don't count hidden teams on the admin panel. - Warn developers on unsupported docker-compose versions. - Directly invalidate LDAP logins without name and password. - Don't show the 'I forgot my password' link on LDAP. The following Rubygems bundled within Portus have been updated to fix security issues: - CVE-2016-2098: rubygem-actionpack (bsc#969943). - CVE-2015-7578: rails-html-sanitizer (bsc#963326). - CVE-2015-7579: rails-html-sanitizer (bsc#963327). - CVE-2015-7580: rails-html-sanitizer (bsc#963328). - CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563). - CVE-2015-7577: rubygem-activerecord (bsc#963604). - CVE-2016-0751: rugygem-actionpack (bsc#963627). - CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608). - CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617). - CVE-2015-7581: rubygem-actionpack (bsc#963625). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Containers-12-2016-672 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ Link for SUSE-SU-2016:1146-1 https://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html E-Mail link for SUSE-SU-2016:1146-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/963326 SUSE Bug 963326 https://bugzilla.suse.com/963327 SUSE Bug 963327 https://bugzilla.suse.com/963328 SUSE Bug 963328 https://bugzilla.suse.com/963563 SUSE Bug 963563 https://bugzilla.suse.com/963604 SUSE Bug 963604 https://bugzilla.suse.com/963608 SUSE Bug 963608 https://bugzilla.suse.com/963617 SUSE Bug 963617 https://bugzilla.suse.com/963625 SUSE Bug 963625 https://bugzilla.suse.com/963627 SUSE Bug 963627 https://bugzilla.suse.com/969943 SUSE Bug 969943 https://www.suse.com/security/cve/CVE-2015-7576/ SUSE CVE CVE-2015-7576 page https://www.suse.com/security/cve/CVE-2015-7577/ SUSE CVE CVE-2015-7577 page https://www.suse.com/security/cve/CVE-2015-7578/ SUSE CVE CVE-2015-7578 page https://www.suse.com/security/cve/CVE-2015-7579/ SUSE CVE CVE-2015-7579 page https://www.suse.com/security/cve/CVE-2015-7580/ SUSE CVE CVE-2015-7580 page https://www.suse.com/security/cve/CVE-2015-7581/ SUSE CVE CVE-2015-7581 page https://www.suse.com/security/cve/CVE-2016-0751/ SUSE CVE CVE-2016-0751 page https://www.suse.com/security/cve/CVE-2016-0752/ SUSE CVE CVE-2016-0752 page https://www.suse.com/security/cve/CVE-2016-0753/ SUSE CVE CVE-2016-0753 page https://www.suse.com/security/cve/CVE-2016-2098/ SUSE CVE CVE-2016-2098 page SUSE Linux Enterprise Module for Containers 12 portus-2.0.3-2.4 portus-2.0.3-2.4 as a component of SUSE Linux Enterprise Module for Containers 12 The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences. CVE-2015-7576 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2015-7576.html CVE-2015-7576 https://bugzilla.suse.com/963329 SUSE Bug 963329 https://bugzilla.suse.com/963563 SUSE Bug 963563 https://bugzilla.suse.com/970715 SUSE Bug 970715 activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature. CVE-2015-7577 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2015-7577.html CVE-2015-7577 https://bugzilla.suse.com/963330 SUSE Bug 963330 https://bugzilla.suse.com/963604 SUSE Bug 963604 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes. CVE-2015-7578 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2015-7578.html CVE-2015-7578 https://bugzilla.suse.com/963326 SUSE Bug 963326 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class. CVE-2015-7579 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2015-7579.html CVE-2015-7579 https://bugzilla.suse.com/963326 SUSE Bug 963326 https://bugzilla.suse.com/963327 SUSE Bug 963327 https://bugzilla.suse.com/963328 SUSE Bug 963328 Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node. CVE-2015-7580 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2015-7580.html CVE-2015-7580 https://bugzilla.suse.com/963326 SUSE Bug 963326 https://bugzilla.suse.com/963327 SUSE Bug 963327 https://bugzilla.suse.com/963328 SUSE Bug 963328 actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route. CVE-2015-7581 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2015-7581.html CVE-2015-7581 https://bugzilla.suse.com/963335 SUSE Bug 963335 actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header. CVE-2016-0751 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2016-0751.html CVE-2016-0751 https://bugzilla.suse.com/963331 SUSE Bug 963331 https://bugzilla.suse.com/963627 SUSE Bug 963627 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. CVE-2016-0752 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2016-0752.html CVE-2016-0752 https://bugzilla.suse.com/963332 SUSE Bug 963332 https://bugzilla.suse.com/963608 SUSE Bug 963608 https://bugzilla.suse.com/968850 SUSE Bug 968850 Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters. CVE-2016-0753 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2016-0753.html CVE-2016-0753 https://bugzilla.suse.com/963334 SUSE Bug 963334 https://bugzilla.suse.com/963617 SUSE Bug 963617 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. CVE-2016-2098 SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/ https://www.suse.com/security/cve/CVE-2016-2098.html CVE-2016-2098 https://bugzilla.suse.com/968849 SUSE Bug 968849 https://bugzilla.suse.com/969943 SUSE Bug 969943 https://bugzilla.suse.com/993313 SUSE Bug 993313