RHSA-2019:2028
Vulnerability from csaf_opensuse - Published: 2019-08-06 00:00 - Updated: 2026-09-20 11:03Summary
security update for ruby
Severity
Moderate
Notes
Title of the patch: security update for ruby
Description of the patch: This security update provides a functional equivalent of RHSA-2019:2028.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2019:2028.
Patchnames: RHSA-2019:2028
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
4.7 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch | — |
Vendor Fix
|
Threats
Impact
low
5.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
moderate
7.8 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
important
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
low
5.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
moderate
4.8 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
moderate
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
low
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
moderate
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
low
Affected products
Recommended
16 products, the same list as for
CVE-2017-17742
Threats
Impact
low
References
54 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for ruby",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2019:2028.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2019:2028.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2019:2028",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2019_2028.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-17742 page",
"url": "https://www.suse.com/security/cve/CVE-2017-17742/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000073 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000073/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000074 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000074/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000075 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000075/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000076 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000076/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000077 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000077/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000078 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000078/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-1000079 page",
"url": "https://www.suse.com/security/cve/CVE-2018-1000079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-16396 page",
"url": "https://www.suse.com/security/cve/CVE-2018-16396/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-6914 page",
"url": "https://www.suse.com/security/cve/CVE-2018-6914/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-8777 page",
"url": "https://www.suse.com/security/cve/CVE-2018-8777/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-8778 page",
"url": "https://www.suse.com/security/cve/CVE-2018-8778/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-8779 page",
"url": "https://www.suse.com/security/cve/CVE-2018-8779/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-8780 page",
"url": "https://www.suse.com/security/cve/CVE-2018-8780/"
}
],
"title": "security update for ruby",
"tracking": {
"current_release_date": "2026-09-20T11:03:50Z",
"generator": {
"date": "2019-08-06T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2019:2028",
"initial_release_date": "2019-08-06T00:00:00Z",
"revision_history": [
{
"date": "2019-08-06T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T11:03:50Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ruby-libs-0:2.0.0.648-36.el7.i686",
"product": {
"name": "ruby-libs-0:2.0.0.648-36.el7.i686",
"product_id": "ruby-libs-0:2.0.0.648-36.el7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/suse/ruby-libs@2.0.0.648-36.el7?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby-doc-0:2.0.0.648-36.el7.noarch",
"product": {
"name": "ruby-doc-0:2.0.0.648-36.el7.noarch",
"product_id": "ruby-doc-0:2.0.0.648-36.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/ruby-doc@2.0.0.648-36.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ruby-irb-0:2.0.0.648-36.el7.noarch",
"product": {
"name": "ruby-irb-0:2.0.0.648-36.el7.noarch",
"product_id": "ruby-irb-0:2.0.0.648-36.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/ruby-irb@2.0.0.648-36.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-minitest-0:4.3.2-36.el7.noarch",
"product": {
"name": "rubygem-minitest-0:4.3.2-36.el7.noarch",
"product_id": "rubygem-minitest-0:4.3.2-36.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/rubygem-minitest@4.3.2-36.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-rake-0:0.9.6-36.el7.noarch",
"product": {
"name": "rubygem-rake-0:0.9.6-36.el7.noarch",
"product_id": "rubygem-rake-0:0.9.6-36.el7.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:ruby-lang:rake:0.9.6:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/rubygem-rake@0.9.6-36.el7?arch=noarch\u0026upstream=rubygem-rake-0:0.9.6-36.el7.src.rpm"
}
}
},
{
"category": "product_version",
"name": "rubygem-rdoc-0:4.0.0-36.el7.noarch",
"product": {
"name": "rubygem-rdoc-0:4.0.0-36.el7.noarch",
"product_id": "rubygem-rdoc-0:4.0.0-36.el7.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:ruby-lang:rdoc:4.0.0:*:*:*:*:ruby:*:*",
"purl": "pkg:rpm/suse/rubygem-rdoc@4.0.0-36.el7?arch=noarch\u0026upstream=rubygem-rdoc-0:4.0.0-36.el7.src.rpm"
}
}
},
{
"category": "product_version",
"name": "rubygems-0:2.0.14.1-36.el7.noarch",
"product": {
"name": "rubygems-0:2.0.14.1-36.el7.noarch",
"product_id": "rubygems-0:2.0.14.1-36.el7.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:rubygems:rubygems:2.0.14.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/rubygems@2.0.14.1-36.el7?arch=noarch\u0026upstream=rubygems-0:2.0.14.1-36.el7.src.rpm"
}
}
},
{
"category": "product_version",
"name": "rubygems-devel-0:2.0.14.1-36.el7.noarch",
"product": {
"name": "rubygems-devel-0:2.0.14.1-36.el7.noarch",
"product_id": "rubygems-devel-0:2.0.14.1-36.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/rubygems-devel@2.0.14.1-36.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby-0:2.0.0.648-36.el7.x86_64",
"product": {
"name": "ruby-0:2.0.0.648-36.el7.x86_64",
"product_id": "ruby-0:2.0.0.648-36.el7.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.0.0.648:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ruby@2.0.0.648-36.el7?arch=x86_64\u0026upstream=ruby-0:2.0.0.648-36.el7.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ruby-devel-0:2.0.0.648-36.el7.x86_64",
"product": {
"name": "ruby-devel-0:2.0.0.648-36.el7.x86_64",
"product_id": "ruby-devel-0:2.0.0.648-36.el7.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:ruby-lang:ruby:2.0.0.648:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ruby-devel@2.0.0.648-36.el7?arch=x86_64\u0026upstream=ruby-0:2.0.0.648-36.el7.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ruby-libs-0:2.0.0.648-36.el7.x86_64",
"product": {
"name": "ruby-libs-0:2.0.0.648-36.el7.x86_64",
"product_id": "ruby-libs-0:2.0.0.648-36.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/ruby-libs@2.0.0.648-36.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"product": {
"name": "ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"product_id": "ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/ruby-tcltk@2.0.0.648-36.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"product": {
"name": "rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"product_id": "rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/rubygem-bigdecimal@1.2.0-36.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-io-console-0:0.4.2-36.el7.x86_64",
"product": {
"name": "rubygem-io-console-0:0.4.2-36.el7.x86_64",
"product_id": "rubygem-io-console-0:0.4.2-36.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/rubygem-io-console@0.4.2-36.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-json-0:1.7.7-36.el7.x86_64",
"product": {
"name": "rubygem-json-0:1.7.7-36.el7.x86_64",
"product_id": "rubygem-json-0:1.7.7-36.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/rubygem-json@1.7.7-36.el7?arch=x86_64\u0026upstream=rubygem-json-0:1.7.7-36.el7.src.rpm"
}
}
},
{
"category": "product_version",
"name": "rubygem-psych-0:2.0.0-36.el7.x86_64",
"product": {
"name": "rubygem-psych-0:2.0.0-36.el7.x86_64",
"product_id": "rubygem-psych-0:2.0.0-36.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/rubygem-psych@2.0.0-36.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 7",
"product": {
"name": "SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-0:2.0.0.648-36.el7.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64"
},
"product_reference": "ruby-0:2.0.0.648-36.el7.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-devel-0:2.0.0.648-36.el7.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64"
},
"product_reference": "ruby-devel-0:2.0.0.648-36.el7.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-doc-0:2.0.0.648-36.el7.noarch as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch"
},
"product_reference": "ruby-doc-0:2.0.0.648-36.el7.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-irb-0:2.0.0.648-36.el7.noarch as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch"
},
"product_reference": "ruby-irb-0:2.0.0.648-36.el7.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-libs-0:2.0.0.648-36.el7.i686 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686"
},
"product_reference": "ruby-libs-0:2.0.0.648-36.el7.i686",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-libs-0:2.0.0.648-36.el7.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64"
},
"product_reference": "ruby-libs-0:2.0.0.648-36.el7.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-tcltk-0:2.0.0.648-36.el7.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64"
},
"product_reference": "ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-bigdecimal-0:1.2.0-36.el7.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64"
},
"product_reference": "rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-io-console-0:0.4.2-36.el7.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64"
},
"product_reference": "rubygem-io-console-0:0.4.2-36.el7.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-0:1.7.7-36.el7.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64"
},
"product_reference": "rubygem-json-0:1.7.7-36.el7.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-minitest-0:4.3.2-36.el7.noarch as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch"
},
"product_reference": "rubygem-minitest-0:4.3.2-36.el7.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-psych-0:2.0.0-36.el7.x86_64 as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64"
},
"product_reference": "rubygem-psych-0:2.0.0-36.el7.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rake-0:0.9.6-36.el7.noarch as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch"
},
"product_reference": "rubygem-rake-0:0.9.6-36.el7.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rdoc-0:4.0.0-36.el7.noarch as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch"
},
"product_reference": "rubygem-rdoc-0:4.0.0-36.el7.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygems-0:2.0.14.1-36.el7.noarch as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch"
},
"product_reference": "rubygems-0:2.0.14.1-36.el7.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygems-devel-0:2.0.14.1-36.el7.noarch as component of SUSE Liberty Linux 7",
"product_id": "SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
},
"product_reference": "rubygems-devel-0:2.0.14.1-36.el7.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-17742",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-17742"
}
],
"notes": [
{
"category": "general",
"text": "Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-17742",
"url": "https://www.suse.com/security/cve/CVE-2017-17742"
},
{
"category": "external",
"summary": "SUSE Bug 1087434 for CVE-2017-17742",
"url": "https://bugzilla.suse.com/1087434"
},
{
"category": "external",
"summary": "SUSE Bug 1136906 for CVE-2017-17742",
"url": "https://bugzilla.suse.com/1136906"
},
{
"category": "external",
"summary": "SUSE Bug 1152992 for CVE-2017-17742",
"url": "https://bugzilla.suse.com/1152992"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2017-17742"
},
{
"cve": "CVE-2018-1000073",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000073"
}
],
"notes": [
{
"category": "general",
"text": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000073",
"url": "https://www.suse.com/security/cve/CVE-2018-1000073"
},
{
"category": "external",
"summary": "SUSE Bug 1082007 for CVE-2018-1000073",
"url": "https://bugzilla.suse.com/1082007"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-1000073"
},
{
"cve": "CVE-2018-1000074",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000074"
}
],
"notes": [
{
"category": "general",
"text": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000074",
"url": "https://www.suse.com/security/cve/CVE-2018-1000074"
},
{
"category": "external",
"summary": "SUSE Bug 1082008 for CVE-2018-1000074",
"url": "https://bugzilla.suse.com/1082008"
},
{
"category": "external",
"summary": "SUSE Bug 1175764 for CVE-2018-1000074",
"url": "https://bugzilla.suse.com/1175764"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-1000074"
},
{
"cve": "CVE-2018-1000075",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000075"
}
],
"notes": [
{
"category": "general",
"text": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000075",
"url": "https://www.suse.com/security/cve/CVE-2018-1000075"
},
{
"category": "external",
"summary": "SUSE Bug 1082014 for CVE-2018-1000075",
"url": "https://bugzilla.suse.com/1082014"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-1000075"
},
{
"cve": "CVE-2018-1000076",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000076"
}
],
"notes": [
{
"category": "general",
"text": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000076",
"url": "https://www.suse.com/security/cve/CVE-2018-1000076"
},
{
"category": "external",
"summary": "SUSE Bug 1082009 for CVE-2018-1000076",
"url": "https://bugzilla.suse.com/1082009"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-1000076"
},
{
"cve": "CVE-2018-1000077",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000077"
}
],
"notes": [
{
"category": "general",
"text": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000077",
"url": "https://www.suse.com/security/cve/CVE-2018-1000077"
},
{
"category": "external",
"summary": "SUSE Bug 1082010 for CVE-2018-1000077",
"url": "https://bugzilla.suse.com/1082010"
},
{
"category": "external",
"summary": "SUSE Bug 1183937 for CVE-2018-1000077",
"url": "https://bugzilla.suse.com/1183937"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-1000077"
},
{
"cve": "CVE-2018-1000078",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000078"
}
],
"notes": [
{
"category": "general",
"text": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000078",
"url": "https://www.suse.com/security/cve/CVE-2018-1000078"
},
{
"category": "external",
"summary": "SUSE Bug 1082011 for CVE-2018-1000078",
"url": "https://bugzilla.suse.com/1082011"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-1000078"
},
{
"cve": "CVE-2018-1000079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-1000079"
}
],
"notes": [
{
"category": "general",
"text": "RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-1000079",
"url": "https://www.suse.com/security/cve/CVE-2018-1000079"
},
{
"category": "external",
"summary": "SUSE Bug 1082058 for CVE-2018-1000079",
"url": "https://bugzilla.suse.com/1082058"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-1000079"
},
{
"cve": "CVE-2018-16396",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-16396"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-16396",
"url": "https://www.suse.com/security/cve/CVE-2018-16396"
},
{
"category": "external",
"summary": "SUSE Bug 1112532 for CVE-2018-16396",
"url": "https://bugzilla.suse.com/1112532"
},
{
"category": "external",
"summary": "SUSE Bug 1136906 for CVE-2018-16396",
"url": "https://bugzilla.suse.com/1136906"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-16396"
},
{
"cve": "CVE-2018-6914",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-6914"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-6914",
"url": "https://www.suse.com/security/cve/CVE-2018-6914"
},
{
"category": "external",
"summary": "SUSE Bug 1087441 for CVE-2018-6914",
"url": "https://bugzilla.suse.com/1087441"
},
{
"category": "external",
"summary": "SUSE Bug 1136906 for CVE-2018-6914",
"url": "https://bugzilla.suse.com/1136906"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-6914"
},
{
"cve": "CVE-2018-8777",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-8777"
}
],
"notes": [
{
"category": "general",
"text": "In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-8777",
"url": "https://www.suse.com/security/cve/CVE-2018-8777"
},
{
"category": "external",
"summary": "SUSE Bug 1087436 for CVE-2018-8777",
"url": "https://bugzilla.suse.com/1087436"
},
{
"category": "external",
"summary": "SUSE Bug 1136906 for CVE-2018-8777",
"url": "https://bugzilla.suse.com/1136906"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-8777"
},
{
"cve": "CVE-2018-8778",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-8778"
}
],
"notes": [
{
"category": "general",
"text": "In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-8778",
"url": "https://www.suse.com/security/cve/CVE-2018-8778"
},
{
"category": "external",
"summary": "SUSE Bug 1087433 for CVE-2018-8778",
"url": "https://bugzilla.suse.com/1087433"
},
{
"category": "external",
"summary": "SUSE Bug 1136906 for CVE-2018-8778",
"url": "https://bugzilla.suse.com/1136906"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-8778"
},
{
"cve": "CVE-2018-8779",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-8779"
}
],
"notes": [
{
"category": "general",
"text": "In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-8779",
"url": "https://www.suse.com/security/cve/CVE-2018-8779"
},
{
"category": "external",
"summary": "SUSE Bug 1087440 for CVE-2018-8779",
"url": "https://bugzilla.suse.com/1087440"
},
{
"category": "external",
"summary": "SUSE Bug 1136906 for CVE-2018-8779",
"url": "https://bugzilla.suse.com/1136906"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-8779"
},
{
"cve": "CVE-2018-8780",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-8780"
}
],
"notes": [
{
"category": "general",
"text": "In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-8780",
"url": "https://www.suse.com/security/cve/CVE-2018-8780"
},
{
"category": "external",
"summary": "SUSE Bug 1087437 for CVE-2018-8780",
"url": "https://bugzilla.suse.com/1087437"
},
{
"category": "external",
"summary": "SUSE Bug 1136906 for CVE-2018-8780",
"url": "https://bugzilla.suse.com/1136906"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 7:ruby-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-devel-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-doc-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-irb-0:2.0.0.648-36.el7.noarch",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.i686",
"SUSE Liberty Linux 7:ruby-libs-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:ruby-tcltk-0:2.0.0.648-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-bigdecimal-0:1.2.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-io-console-0:0.4.2-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-json-0:1.7.7-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-minitest-0:4.3.2-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-psych-0:2.0.0-36.el7.x86_64",
"SUSE Liberty Linux 7:rubygem-rake-0:0.9.6-36.el7.noarch",
"SUSE Liberty Linux 7:rubygem-rdoc-0:4.0.0-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-0:2.0.14.1-36.el7.noarch",
"SUSE Liberty Linux 7:rubygems-devel-0:2.0.14.1-36.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-08-06T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-8780"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…