CVE-2018-8778

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.

Ruby before 2.2.10 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick (CVE-2017-17742).

Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument (CVE-2018-6914).

In Ruby before 2.2.10, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption) (CVE-2018-8777).

In Ruby before 2.2.10, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure (CVE-2018-8778).

In Ruby before 2.2.10, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket (CVE-2018-8779).

In Ruby before 2.2.10, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed (CVE-2018-8780).

Due to a bug in the equality check of OpenSSL::X509::Name, if a malicious X.509 certificate is passed to compare with an existing certificate, there is a possibility to be judged incorrectly that they are equal (CVE-2018-16395).

In Array#pack and String#unpack with some formats, the tainted flags of the original data are not propagated to the returned string/array (CVE-2018-16396).

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues:

Changes in ruby2.5:

Update to 2.5.5 and 2.5.4:

https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/

Security issues fixed:

• CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627)
• CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623)
• CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622)
• CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620)
• CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617)
• CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611)

Ruby 2.5 was updated to 2.5.3:

This release includes some bug fixes and some security fixes.

Security issues fixed:

• CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532)
• CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530)

Ruby 2.5 was updated to 2.5.1:

This release includes some bug fixes and some security fixes.

Security issues fixed:

• CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434)

• CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441)

• CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436)

• CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433)

• CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440)

• CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437)

• Multiple vulnerabilities in RubyGems were fixed:

  • CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058)
  • CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014)
  • CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011)
  • CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010)
  • CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009)
  • CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008)
  • CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007)

Other changes:

• Fixed Net::POPMail methods modify frozen literal when using default arg
• ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790)
• build with PIE support (bsc#1130028)

Changes in ruby-bundled-gems-rpmhelper:

• Add a new helper for bundled ruby gems.

This update was imported from the SUSE:SLE-15:Update update project.

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues:

Changes in ruby2.5:

Update to 2.5.5 and 2.5.4:

https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/

Security issues fixed:

• CVE-2019-8320: Delete directory using symlink when decompressing tar (bsc#1130627)
• CVE-2019-8321: Escape sequence injection vulnerability in verbose (bsc#1130623)
• CVE-2019-8322: Escape sequence injection vulnerability in gem owner (bsc#1130622)
• CVE-2019-8323: Escape sequence injection vulnerability in API response handling (bsc#1130620)
• CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution (bsc#1130617)
• CVE-2019-8325: Escape sequence injection vulnerability in errors (bsc#1130611)

Ruby 2.5 was updated to 2.5.3:

This release includes some bug fixes and some security fixes.

Security issues fixed:

• CVE-2018-16396: Tainted flags are not propagated in Array#pack and String#unpack with some directives (bsc#1112532)
• CVE-2018-16395: OpenSSL::X509::Name equality check does not work correctly (bsc#1112530)

Ruby 2.5 was updated to 2.5.1:

This release includes some bug fixes and some security fixes.

Security issues fixed:

• CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434)

• CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441)

• CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436)

• CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433)

• CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440)

• CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437)

• Multiple vulnerabilities in RubyGems were fixed:

  • CVE-2018-1000079: Fixed path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058)
  • CVE-2018-1000075: Fixed infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014)
  • CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when displayed via gem server (bsc#1082011)
  • CVE-2018-1000077: Fixed that missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL (bsc#1082010)
  • CVE-2018-1000076: Fixed improper verification of signatures in tarball allows to install mis-signed gem (bsc#1082009)
  • CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML (bsc#1082008)
  • CVE-2018-1000073: Fixed path traversal when writing to a symlinked basedir outside of the root (bsc#1082007)

Other changes:

• Fixed Net::POPMail methods modify frozen literal when using default arg
• ruby: change over of the Japanese Era to the new emperor May 1st 2019 (bsc#1133790)
• build with PIE support (bsc#1130028)

Changes in ruby-bundled-gems-rpmhelper:

• Add a new helper for bundled ruby gems.

This update for ruby2.1 fixes the following issues:

Security issues fixed:

• CVE-2015-9096: Fixed an SMTP command injection via CRLFsequences in a RCPT TO or MAIL FROM command (bsc#1043983).
• CVE-2016-7798: Fixed an IV Reuse in GCM Mode (bsc#1055265).
• CVE-2017-0898: Fixed a buffer underrun vulnerability in Kernel.sprintf (bsc#1058755).
• CVE-2017-0899: Fixed an issue with malicious gem specifications, insufficient sanitation when printing gem specifications could have included terminal characters (bsc#1056286).
• CVE-2017-0900: Fixed an issue with malicious gem specifications, the query command could have led to a denial of service attack against clients (bsc#1056286).
• CVE-2017-0901: Fixed an issue with malicious gem specifications, potentially overwriting arbitrary files on the client system (bsc#1056286).
• CVE-2017-0902: Fixed an issue with malicious gem specifications, that could have enabled MITM attacks against clients (bsc#1056286).
• CVE-2017-0903: Fixed an unsafe object deserialization vulnerability (bsc#1062452).
• CVE-2017-9228: Fixed a heap out-of-bounds write in bitset_set_range() during regex compilation (bsc#1069607).
• CVE-2017-9229: Fixed an invalid pointer dereference in left_adjust_char_head() in oniguruma (bsc#1069632).
• CVE-2017-10784: Fixed an escape sequence injection vulnerability in the Basic authentication of WEBrick (bsc#1058754).
• CVE-2017-14033: Fixed a buffer underrun vulnerability in OpenSSL ASN1 decode (bsc#1058757).
• CVE-2017-14064: Fixed an arbitrary memory exposure during a JSON.generate call (bsc#1056782).
• CVE-2017-17405: Fixed a command injection vulnerability in Net::FTP (bsc#1073002).
• CVE-2017-17742: Fixed an HTTP response splitting issue in WEBrick (bsc#1087434).
• CVE-2017-17790: Fixed a command injection in lib/resolv.rb:lazy_initialize() (bsc#1078782).
• CVE-2018-6914: Fixed an unintentional file and directory creation with directory traversal in tempfile and tmpdir (bsc#1087441).
• CVE-2018-8777: Fixed a potential DoS caused by large requests in WEBrick (bsc#1087436).
• CVE-2018-8778: Fixed a buffer under-read in String#unpack (bsc#1087433).
• CVE-2018-8779: Fixed an unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket (bsc#1087440).
• CVE-2018-8780: Fixed an unintentional directory traversal by poisoned NUL byte in Dir (bsc#1087437).
• CVE-2018-16395: Fixed an issue with OpenSSL::X509::Name equality checking (bsc#1112530).
• CVE-2018-16396: Fixed an issue with tainted string handling, where the flag was not propagated in Array#pack and String#unpack with some directives (bsc#1112532).
• CVE-2018-1000073: Fixed a path traversal issue (bsc#1082007).
• CVE-2018-1000074: Fixed an unsafe object deserialization vulnerability in gem owner, allowing arbitrary code execution with specially crafted YAML (bsc#1082008).
• CVE-2018-1000075: Fixed an infinite loop vulnerability due to negative size in tar header causes Denial of Service (bsc#1082014).
• CVE-2018-1000076: Fixed an improper verification of signatures in tarballs (bsc#1082009).
• CVE-2018-1000077: Fixed an improper URL validation in the homepage attribute of ruby gems (bsc#1082010).
• CVE-2018-1000078: Fixed a XSS vulnerability in the homepage attribute when displayed via gem server (bsc#1082011).
• CVE-2018-1000079: Fixed a path traversal issue during gem installation allows to write to arbitrary filesystem locations (bsc#1082058).
• CVE-2019-8320: Fixed a directory traversal issue when decompressing tar files (bsc#1130627).
• CVE-2019-8321: Fixed an escape sequence injection vulnerability in verbose (bsc#1130623).
• CVE-2019-8322: Fixed an escape sequence injection vulnerability in gem owner (bsc#1130622).
• CVE-2019-8323: Fixed an escape sequence injection vulnerability in API response handling (bsc#1130620).
• CVE-2019-8324: Fixed an issue with malicious gems that may have led to arbitrary code execution (bsc#1130617).
• CVE-2019-8325: Fixed an escape sequence injection vulnerability in…

It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. (CVE-2018-6914)

It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. (CVE-2018-8778, CVE-2018-8780)

It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to connect to an unintended socket. (CVE-2018-8779)