Security update for rubygem-loofah SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:1657-1 Final 1 1 2023-03-29T07:38:54Z current 2023-03-29T07:38:54Z 2023-03-29T07:38:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-loofah This update for rubygem-loofah fixes the following issues: - CVE-2022-23514: Fixed inefficient regular expression leading to denial of service (bsc#1206415). - CVE-2022-23515: Fixed improper neutralization of data URIs leading to Cross Site Scripting (bsc#1206417). - CVE-2022-23516: Fixed uncontrolled Recursion leading to denial of service (bsc#1206416). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2023-1657,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2023-1657,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2023-1657,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2023-1657,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2023-1657,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2023-1657,Image SLES15-SP4-SAP-Azure-LI-BYOS-2023-1657,Image SLES15-SP4-SAP-Azure-LI-BYOS-Production-2023-1657,Image SLES15-SP4-SAP-Azure-VLI-BYOS-2023-1657,Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production-2023-1657,Image SLES15-SP4-SAP-BYOS-2023-1657,Image SLES15-SP4-SAP-BYOS-Azure-2023-1657,Image SLES15-SP4-SAP-BYOS-EC2-2023-1657,Image SLES15-SP4-SAP-BYOS-GCE-2023-1657,Image SLES15-SP4-SAP-Hardened-2023-1657,Image SLES15-SP4-SAP-Hardened-Azure-2023-1657,Image SLES15-SP4-SAP-Hardened-BYOS-2023-1657,Image SLES15-SP4-SAP-Hardened-BYOS-Azure-2023-1657,Image SLES15-SP4-SAP-Hardened-BYOS-EC2-2023-1657,Image SLES15-SP4-SAP-Hardened-BYOS-GCE-2023-1657,Image SLES15-SP4-SAP-Hardened-EC2-2023-1657,Image SLES15-SP4-SAP-Hardened-GCE-2023-1657,Image SLES15-SP5-SAP-Azure-LI-BYOS-2023-1657,Image SLES15-SP5-SAP-Azure-LI-BYOS-Production-2023-1657,Image SLES15-SP5-SAP-Azure-VLI-BYOS-2023-1657,Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production-2023-1657,Image SLES15-SP5-SAP-BYOS-Azure-2023-1657,Image SLES15-SP5-SAP-BYOS-EC2-2023-1657,Image SLES15-SP5-SAP-BYOS-GCE-2023-1657,Image SLES15-SP5-SAP-Hardened-Azure-2023-1657,Image SLES15-SP5-SAP-Hardened-BYOS-Azure-2023-1657,Image SLES15-SP5-SAP-Hardened-BYOS-EC2-2023-1657,Image SLES15-SP5-SAP-Hardened-BYOS-GCE-2023-1657,Image SLES15-SP5-SAP-Hardened-EC2-2023-1657,Image SLES15-SP5-SAP-Hardened-GCE-2023-1657,SUSE-2023-1657,SUSE-SLE-Product-HA-15-SP1-2023-1657,SUSE-SLE-Product-HA-15-SP2-2023-1657,SUSE-SLE-Product-HA-15-SP3-2023-1657,SUSE-SLE-Product-HA-15-SP4-2023-1657,openSUSE-SLE-15.4-2023-1657 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20231657-1/ Link for SUSE-SU-2023:1657-1 https://lists.suse.com/pipermail/sle-updates/2023-March/028447.html E-Mail link for SUSE-SU-2023:1657-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1206415 SUSE Bug 1206415 https://bugzilla.suse.com/1206416 SUSE Bug 1206416 https://bugzilla.suse.com/1206417 SUSE Bug 1206417 https://www.suse.com/security/cve/CVE-2022-23514/ SUSE CVE CVE-2022-23514 page https://www.suse.com/security/cve/CVE-2022-23515/ SUSE CVE CVE-2022-23515 page https://www.suse.com/security/cve/CVE-2022-23516/ SUSE CVE CVE-2022-23516 page Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-EC2 Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-BYOS-Azure Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-GCE Image SLES15-SP5-SAP-Hardened-Azure Image SLES15-SP5-SAP-Hardened-BYOS-Azure Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Hardened-EC2 Image SLES15-SP5-SAP-Hardened-GCE SUSE Linux Enterprise High Availability Extension 15 SP1 SUSE Linux Enterprise High Availability Extension 15 SP2 SUSE Linux Enterprise High Availability Extension 15 SP3 SUSE Linux Enterprise High Availability Extension 15 SP4 openSUSE Leap 15.4 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 ruby2.5-rubygem-loofah-doc-2.2.2-150000.4.9.1 ruby2.5-rubygem-loofah-testsuite-2.2.2-150000.4.9.1 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-BYOS ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-BYOS-Azure ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-BYOS-EC2 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-BYOS-GCE ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Hardened ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Hardened-Azure ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-Azure ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-EC2 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-GCE ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Hardened-EC2 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP4-SAP-Hardened-GCE ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-BYOS-Azure ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-BYOS-EC2 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-BYOS-GCE ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Hardened-Azure ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-Azure ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-EC2 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-GCE ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Hardened-EC2 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of Image SLES15-SP5-SAP-Hardened-GCE ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP1 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP2 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP3 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP4 ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 as a component of openSUSE Leap 15.4 ruby2.5-rubygem-loofah-doc-2.2.2-150000.4.9.1 as a component of openSUSE Leap 15.4 ruby2.5-rubygem-loofah-testsuite-2.2.2-150000.4.9.1 as a component of openSUSE Leap 15.4 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. CVE-2022-23514 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP1:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP3:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP4:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-doc-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-testsuite-2.2.2-150000.4.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231657-1/ https://www.suse.com/security/cve/CVE-2022-23514.html CVE-2022-23514 https://bugzilla.suse.com/1206415 SUSE Bug 1206415 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1. CVE-2022-23515 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP1:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP3:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP4:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-doc-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-testsuite-2.2.2-150000.4.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231657-1/ https://www.suse.com/security/cve/CVE-2022-23515.html CVE-2022-23515 https://bugzilla.suse.com/1206417 SUSE Bug 1206417 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized. CVE-2022-23516 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP4-SAP-Hardened:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-EC2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 Image SLES15-SP5-SAP-Hardened-GCE:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP1:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP2:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP3:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 SUSE Linux Enterprise High Availability Extension 15 SP4:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-doc-2.2.2-150000.4.9.1 openSUSE Leap 15.4:ruby2.5-rubygem-loofah-testsuite-2.2.2-150000.4.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231657-1/ https://www.suse.com/security/cve/CVE-2022-23516.html CVE-2022-23516 https://bugzilla.suse.com/1206416 SUSE Bug 1206416