Security update for ruby SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:15034-1 Final 1 1 2022-09-06T11:58:31Z current 2022-09-06T11:58:31Z 2022-09-06T11:58:31Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ruby This update for ruby fixes the following issues: - CVE-2018-16395: Fixed an issue where two x509 certificates could be considered to be equal when this was not the case (bsc#1112530). - CVE-2021-32066: Fixed an issue where the IMAP client API would not report a failure when StartTLS failed, leading to potential man in the middle attacks (bsc#1188160). - CVE-2021-31810: Fixed an issue where the FTP client API would trust certain responses from a malicious server, tricking the client into connecting to addresses not (bsc#1188161). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slewyst13-ruby-15034 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-202215034-1/ Link for SUSE-SU-2022:15034-1 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012115.html E-Mail link for SUSE-SU-2022:15034-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1112530 SUSE Bug 1112530 https://bugzilla.suse.com/1188160 SUSE Bug 1188160 https://bugzilla.suse.com/1188161 SUSE Bug 1188161 https://www.suse.com/security/cve/CVE-2018-16395/ SUSE CVE CVE-2018-16395 page https://www.suse.com/security/cve/CVE-2021-31810/ SUSE CVE CVE-2021-31810 page https://www.suse.com/security/cve/CVE-2021-32066/ SUSE CVE CVE-2021-32066 page https://www.suse.com/security/cve/CVE-2021-81810/ SUSE CVE CVE-2021-81810 page SUSE WebYast 1.3 ruby-devel-1.8.7.p357-0.9.20.3.1 ruby-devel-1.8.7.p357-0.9.20.3.1 as a component of SUSE WebYast 1.3 An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations. CVE-2018-16395 SUSE WebYast 1.3:ruby-devel-1.8.7.p357-0.9.20.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202215034-1/ https://www.suse.com/security/cve/CVE-2018-16395.html CVE-2018-16395 https://bugzilla.suse.com/1112530 SUSE Bug 1112530 https://bugzilla.suse.com/1136906 SUSE Bug 1136906 An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). CVE-2021-31810 SUSE WebYast 1.3:ruby-devel-1.8.7.p357-0.9.20.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202215034-1/ https://www.suse.com/security/cve/CVE-2021-31810.html CVE-2021-31810 https://bugzilla.suse.com/1188161 SUSE Bug 1188161 https://bugzilla.suse.com/1193383 SUSE Bug 1193383 https://bugzilla.suse.com/1205053 SUSE Bug 1205053 An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." CVE-2021-32066 SUSE WebYast 1.3:ruby-devel-1.8.7.p357-0.9.20.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202215034-1/ https://www.suse.com/security/cve/CVE-2021-32066.html CVE-2021-32066 https://bugzilla.suse.com/1188160 SUSE Bug 1188160 https://bugzilla.suse.com/1196771 SUSE Bug 1196771 https://bugzilla.suse.com/1205053 SUSE Bug 1205053 unknown CVE-2021-81810 SUSE WebYast 1.3:ruby-devel-1.8.7.p357-0.9.20.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202215034-1/ https://www.suse.com/security/cve/CVE-2021-81810.html CVE-2021-81810