CVE-2019-5477

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being called with unsafe user input as the filename (CVE-2019-5477).

In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible (CVE-2020-26247).

The ruby-nokogiri package has been updated to version 1.10.10 to fix CVE-2019-5477 and patched to fix CVE-2020-26247.

This update for rubygem-nokogiri fixes the following issues:

rubygem-nokogiri was updated to 1.8.5 (bsc#1156722).

Security issues fixed:

• CVE-2019-5477: Fixed a command injection vulnerability (bsc#1146578).
• CVE-2020-26247: Fixed an XXE vulnerability in Nokogiri::XML::Schema (bsc#1180507).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the ruby2.7-rubygem-nokogiri-1.12.3-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

This update for crowbar-core, crowbar-openstack, grafana, novnc, openstack-keystone, openstack-neutron, openstack-neutron-lbaas, openstack-nova, openstack-tempest, python-pysaml2, python-urllib3, rubygem-chef, rubygem-easy_diff, sleshammer fixes the following issues:

In python-pysaml2 the following security issue was fixed:

• CVE-2016-10127: Fixed an XML external entity attack. (bsc#1019074)

crowbar-core was updated to version 4.0+git.1570463621.40b11cd48:

• network: Don't set datapath-ids on ovs-bridges anymore (bsc#1152916)
• barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)
• gems: Update easy_diff to 1.0.0 (SOC-10505)
• crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
• transition.sh: Do not read /etc/crowbar.install.key
• gather_logs: Make it a bit useful again
• gather_logs: Do not read /etc/crowbar.install.key
• network: Allow locking down the network config for nodes (bsc#1120657)
• network: Check existing upper layers before bond setup (bsc#1120657)
• network: never plug two interface into the same ovs bridge (bsc#1120657)
• network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
• nic library: some helper for identifying base interface (bsc#1120657)
• network: Rework the vlan port replugging code (bsc#1120657)
• network: DRY out 'kill_nic_files' (noref)
• Add CVE-2019-5477 the to travis ignore list (SOC-9635)

crowbar-openstack was updated to version 4.0+git.1569429513.e7016b2b6:

• tempest: don't rely on service catalogue (SOC-10633)
• nova: set default attribute for max_threads_per_process
• database: Hardcode ruby version for package installation (SOC-10010)
• neutron: restore dhcp_domain in stable/4.0 (bsc#1145867)
• nova: add max_threads_per_process tuneable (SOC-10001, bsc#1133719)

grafana was updated to:

• CVE-2019-15043: Adds authentication to a few rest endpoints that could be used to access grafana snapshot apis to cause denial of service (SOC-10357 bsc#1148383) Also see https://github.com/grafana/grafana/compare/v5.4.4...v5.4.5

grafana was updated to version 4.6.5:

• CVE-2018-19039: Users with Editor or Admin permissions could exfiltrate files (jsc#SOC-9976 bsc#1115960)

grafana was updated version to 4.6.4:

• CVE-2018-15727 / CVE-2018-558213: Fixed an authentication bypass because an attacker can generate a valid 'remember me'cookie knowing only a username of an LDAP or OAuth user (jsc#SOC-9980 bsc#1106515)

Other fixes:

• sql: added code migration type
• release 4.6.3
• fix default alias
• fixes broken alert eval when first condition is using OR
• fix: alert list panel now works correctly after adding manual annotation on dashboard, fixes #9951
• fix: fix for avatar images when gzip is turned on, fixes #5952
• sets version to 4.6.2
• prom: add support for default step param (#9866)
• build: fixed jshint error
• fix: Html escaping caused issue in InfluxDB query editor, could not pick greater than or less then operators, fixes #9871
• heatmap: fix tooltip in 'Time series bucket' mode, #9332 (#9867)
• fix cloudwatch ec2_instance_attribute (#9718)
• colorpicker: fix color string change #9769 (#9780)
• changes version to 4.6.1
• fix: panel view now wraps, no scrolling required, fixes #9746
• plugins: fix for loading external plugins behind auth proxy, fixes #9509
• fix: color picker bug at series overrides page, #9715 (#9738)
• tech: switch to golang 1.9.2
• tech: add missing include
• save as should only delete threshold for panels with alerts
• fix: graphite annotation tooltip included undefined, fixes #9707
• build: updated version to v4.6.0
• plugins: added backward compatible path for rxjs
• ux: updated singlestat default colors
• prometheus: fixed unsaved changes warning when changing time range due to step option on query model was changed in datasource.query code, fixes #9675
• fix: firefox can now create region annotations, fixes #9638
• alerting: only editors can pause rules
• fix: another fix for playlist view state, #9639…

This update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone contains the following fixes:

• Update to version 8.0+git.1566374355.c509923:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 8.0+git.1566376789.be0fe01:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 8.0+git.1565816064.5d4f73f:

  • Removed None condition from rule (SOC-10003)

• Update to version 8.0+git.1566517401.98450e6:

  • Add neutron-fwaas.json when neutron-l3-agent is deployed (SOC-10280)

• Update to version 8.0+git.1568835837.2452e7a:

  • Ensure Manila services don't auto start on reboot (SOC-10641)

• Update to version 8.0+git.1568220097.74ee4b4:

  • API extension paths separated by colon (SOC-10447)

• Update to version 8.0+git.1567555448.5ecd5b0:

  • Add dependent services to neutron services (SOC-8746)

• Update to version 8.0+git.1566517377.f2a8c54:

  • Add policy.d/neutron-fwaas.json.j2 (SOC-10280)

• Update to version 8.0+git.1566902754.c58ff69:

  • Install libosinfo package (SOC-10295)

• Update to version 8.0+git.1565946419.a76c00e:

  • Set diskcachemode and disk discard when using RBD (SOC-10182)

• Update to version 8.0+git.1568373448.bcaee7e:

  • Make octavia heartbeat frequency options configurable (SOC-9285)

• Update to version 8.0+git.1566374572.a3c91d9:

  • Include SES variables when configuring image (SOC-9285)

• Update to version 8.0+git.1566208257.5213d93:

  • Use default values for amphora connection retries/timeout (SOC-9285)

• Update to version 8.0+git.1566471887.fd2fec7:

  • Delete existing run filter before deploying it (SOC-10287)

• Update to version 5.0+git.1569597589.1f025c557:

  • barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)

• Update to version 5.0+git.1569231378.ac645b753:

  • Revert 'batch: Use easy_merge for merging (SOC-10505)'

• Update to version 5.0+git.1569103607.ee4a6cbc9:

  • upgrade: Fix pie chart colors on dashboard (SOC-10619)

• Update to version 5.0+git.1568983947.70c39b8c7:

  • batch: Use easy_merge for merging (SOC-10505)

• Update to version 5.0+git.1568317972.dfb856def:

  • upgrade: Fix pre-checks tests (SOC-9868)
  • Allow designate rndc for all nodes (SOC-10339)

• Update to version 5.0+git.1568210854.4f87b86f8:

  • gems: Update easy_diff to 1.0.0 (SOC-10505)

• Update to version 5.0+git.1567531836.e06d68030:

  • Public ips for dns nodes when designate integration is in use (SOC-9635)

• Update to version 5.0+git.1567513044.e9ef28b03:

  • crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
  • transition.sh: Do not read /etc/crowbar.install.key
  • gather_logs: Make it a bit useful again
  • gather_logs: Do not read /etc/crowbar.install.key
  • network: Check existing upper layers before bond setup (bsc#1120657)
  • network: never plug two interface into the same ovs bridge (bsc#1120657)
  • network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
  • nic library: some helper for identifying base interface (bsc#1120657)
  • network: Rework the vlan port replugging code (bsc#1120657)
  • network: DRY out 'kill_nic_files' (noref)

• Update to version 5.0+git.1567161136.fa34ac9f2:

  • Add CVE-2019-5477 the to travis ignore list (SOC-9635)

• Update to version 5.0+git.1567094388.48f2be817:

  • upgrade: Add more prechecks for 8->9 (SOC-9868)

• Update…

This update for rubygem-nokogiri fixes the following issues:

• CVE-2019-5477: Fixed a command injection vulnerability (bsc#1146578).
• CVE-2020-26247: Fixed an XXE vulnerability in Nokogiri::XML::Schema (bsc#1180507).

This update for rubygem-nokogiri fixes the following issues:

rubygem-nokogiri was updated to 1.8.5 (bsc#1156722).

Security issues fixed:

• CVE-2019-5477: Fixed a command injection vulnerability (bsc#1146578).
• CVE-2020-26247: Fixed an XXE vulnerability in Nokogiri::XML::Schema (bsc#1180507).

It was discovered that Nokogiri incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands.