CVE-2016-0751

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

This update for rubygem-actionpack-4_2 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335)
• CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-actionpack-3_2 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2016-0752: Directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-actionpack-4_1 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335)
• CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

Portus was updated to version 2.0.3, which brings several fixes and enhancements:

• Fixed crono job when a repository could not be found.
• Fixed compatibility issues with Docker 1.10 and Distribution 2.3.
• Handle multiple scopes in token requests.
• Add optional fields to token response.
• Fixed notification events for Distribution v2.3.
• Paginate through the catalog properly.
• Do not remove all the repositories if fetching one fails.
• Fixed SMTP setup.
• Don't let crono overflow the 'log' column on the DB.
• Show the actual LDAP error on invalid login.
• Fixed the location of crono logs.
• Always use relative paths.
• Set RUBYLIB when using portusctl.
• Don't count hidden teams on the admin panel.
• Warn developers on unsupported docker-compose versions.
• Directly invalidate LDAP logins without name and password.
• Don't show the 'I forgot my password' link on LDAP.

The following Rubygems bundled within Portus have been updated to fix security issues:

• CVE-2016-2098: rubygem-actionpack (bsc#969943).
• CVE-2015-7578: rails-html-sanitizer (bsc#963326).
• CVE-2015-7579: rails-html-sanitizer (bsc#963327).
• CVE-2015-7580: rails-html-sanitizer (bsc#963328).
• CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).
• CVE-2015-7577: rubygem-activerecord (bsc#963604).
• CVE-2016-0751: rugygem-actionpack (bsc#963627).
• CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).
• CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).
• CVE-2015-7581: rubygem-actionpack (bsc#963625).

This update provides SUSE Studio Runner 1.3.14, which brings fixes for the following issues:

• bsc#968797: 11 SP3 appliance gets invalid distribution upgrade from SLMS.
• bsc#947225: Second build of appliance will not register to SLMS, wrong product name.
• bsc#983404: UEFI boot missing for SLE11 SP4.
• bsc#972406: Kiwi export config.sh script has /build-custom out of order.
• bsc#981095: Add user 'ldap' to default_users list for assigning owners for overlay files.
• bsc#972425: Runlevel 3 is being ignored in appliance configuration.
• bsc#983999: SLES 12 appliance build does not include gpg keys from base product.
• bsc#979110: SLES 12 will not build for EC2.
• bsc#929102: Plaintext Password Local Disclosure in rubygem-rest-client. (CVE-2015-3448)
• bsc#963741: Security fixes for Rails v3.2.22. (CVE-2015-7576, CVE-2015-7577, CVE-2016-0751, CVE-2016-0752)