Security update for ruby SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0948-1 Final 1 1 2017-04-06T09:39:44Z current 2017-04-06T09:39:44Z 2017-04-06T09:39:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ruby This update for ruby fixes the following issues: Secuirty issues fixed: - CVE-2015-1855: Ruby OpenSSL Hostname Verification (bsc#926974) - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495) Bugfixes: - fix small mistake in the backport for (bsc#986630) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ruby-13052,sleslms13-ruby-13052,slessp4-ruby-13052,slestso13-ruby-13052,slewyst13-ruby-13052 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170948-1/ Link for SUSE-SU-2017:0948-1 https://lists.suse.com/pipermail/sle-security-updates/2017-April/002786.html E-Mail link for SUSE-SU-2017:0948-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/926974 SUSE Bug 926974 https://bugzilla.suse.com/959495 SUSE Bug 959495 https://bugzilla.suse.com/986630 SUSE Bug 986630 https://www.suse.com/security/cve/CVE-2015-1855/ SUSE CVE CVE-2015-1855 page https://www.suse.com/security/cve/CVE-2015-7551/ SUSE CVE CVE-2015-7551 page SUSE Lifecycle Management Server 1.3 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 SUSE WebYast 1.3 ruby-devel-1.8.7.p357-0.9.19.1 ruby-doc-html-1.8.7.p357-0.9.19.1 ruby-doc-ri-1.8.7.p357-0.9.19.1 ruby-examples-1.8.7.p357-0.9.19.1 ruby-test-suite-1.8.7.p357-0.9.19.1 ruby-tk-1.8.7.p357-0.9.19.1 ruby-1.8.7.p357-0.9.19.1 ruby-devel-1.8.7.p357-0.9.19.1 as a component of SUSE Lifecycle Management Server 1.3 ruby-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Server 11 SP4 ruby-doc-html-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Server 11 SP4 ruby-tk-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Server 11 SP4 ruby-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ruby-doc-html-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ruby-tk-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ruby-devel-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ruby-doc-html-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ruby-doc-ri-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ruby-examples-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ruby-test-suite-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ruby-tk-1.8.7.p357-0.9.19.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ruby-devel-1.8.7.p357-0.9.19.1 as a component of SUSE Studio Onsite 1.3 ruby-devel-1.8.7.p357-0.9.19.1 as a component of SUSE WebYast 1.3 verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters. CVE-2015-1855 SUSE Lifecycle Management Server 1.3:ruby-devel-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server 11 SP4:ruby-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server 11 SP4:ruby-doc-html-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server 11 SP4:ruby-tk-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ruby-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ruby-doc-html-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ruby-tk-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-devel-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-doc-html-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-doc-ri-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-examples-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-test-suite-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-tk-1.8.7.p357-0.9.19.1 SUSE Studio Onsite 1.3:ruby-devel-1.8.7.p357-0.9.19.1 SUSE WebYast 1.3:ruby-devel-1.8.7.p357-0.9.19.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170948-1/ https://www.suse.com/security/cve/CVE-2015-1855.html CVE-2015-1855 https://bugzilla.suse.com/926974 SUSE Bug 926974 The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression. CVE-2015-7551 SUSE Lifecycle Management Server 1.3:ruby-devel-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server 11 SP4:ruby-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server 11 SP4:ruby-doc-html-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server 11 SP4:ruby-tk-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ruby-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ruby-doc-html-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ruby-tk-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-devel-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-doc-html-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-doc-ri-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-examples-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-test-suite-1.8.7.p357-0.9.19.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ruby-tk-1.8.7.p357-0.9.19.1 SUSE Studio Onsite 1.3:ruby-devel-1.8.7.p357-0.9.19.1 SUSE WebYast 1.3:ruby-devel-1.8.7.p357-0.9.19.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170948-1/ https://www.suse.com/security/cve/CVE-2015-7551.html CVE-2015-7551 https://bugzilla.suse.com/939860 SUSE Bug 939860 https://bugzilla.suse.com/959495 SUSE Bug 959495