CVE-2023-28120

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized. When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation. Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Security Fix(es):

A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrusted user input, malicious code could be executed.(CVE-2023-28120)

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Security Fix(es):

A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrusted user input, malicious code could be executed.(CVE-2023-28120)

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Security Fix(es):

A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrusted user input, malicious code could be executed.(CVE-2023-28120)

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Security Fix(es):

A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrusted user input, malicious code could be executed.(CVE-2023-28120)

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

These are all security issues fixed in the ruby3.1-rubygem-activesupport-7.0-7.0.4.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rmt-server-2.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-activesupport-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-activesupport-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.

This update for rmt-server fixes the following issues:

Updated to version 2.13:

• CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency (bsc#1209507).
• CVE-2023-27530: Fixed a denial of service issue in multipart request parsing (bsc#1209096).

Non-security fixes:

• Fixed transactional update on GCE (bsc#1211398).
• Use HTTPS in rmt-client-setup-res (bsc#1209825).
• Various build fixes (bsc#1207670, bsc#1203171, bsc#1206593, bsc#1202053).

This update for rmt-server fixes the following issues:

Updated to version 2.13:

• CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency (bsc#1209507).
• CVE-2023-27530: Fixed a denial of service issue in multipart request parsing (bsc#1209096).

Non-security fixes:

• Fixed transactional update on GCE (bsc#1211398).
• Use HTTPS in rmt-client-setup-res (bsc#1209825).
• Various build fixes (bsc#1207670, bsc#1203171, bsc#1206593, bsc#1202053).

This update for rmt-server fixes the following issues:

Updated to version 2.13:

• CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency (bsc#1209507).
• CVE-2023-27530: Fixed a denial of service issue in multipart request parsing (bsc#1209096).

Non-security fixes:

• Fixed transactional update on GCE (bsc#1211398).
• Use HTTPS in rmt-client-setup-res (bsc#1209825).
• Various build fixes (bsc#1207670, bsc#1203171, bsc#1206593, bsc#1202053).

This update for rmt-server fixes the following issues:

Updated to version 2.13:

• CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency (bsc#1209507).
• CVE-2023-27530: Fixed a denial of service issue in multipart request parsing (bsc#1209096).

Non-security fixes:

• Fixed transactional update on GCE (bsc#1211398).
• Use HTTPS in rmt-client-setup-res (bsc#1209825).
• Various build fixes (bsc#1207670, bsc#1203171, bsc#1206593, bsc#1202053).

This update for rmt-server fixes the following issues:

Update to version 2.13:

• CVE-2023-28120: Fixed a possible XSS Security Vulnerability in bytesliced strings for html_safe (bsc#1209507).
• CVE-2023-27530: Fixed a DoS in multipart mime parsing (bsc#1209096).
• CVE-2022-31254: Fixed escalation vector bug from user _rmt to root in the packaging file (bsc#1204285).

Bug fixes:

• Handle X-Original-URI header, partial fix for (bsc#1211398)
• Force rmt-client-setup-res script to use https (bsc#1209825)
• Mark secrets.yml.key file as part of the rpm to allow seamless downgrades (bsc#1207670)
• Adding -f to the file move command when moving the mirrored directory to its final location (bsc#1203171)
• Fix %post install of pubcloud subpackage reload of nginx (bsc#1206593)
• Skip warnings regarding nokogiri libxml version mismatch (bsc#1202053)
• Add option to turn off system token support (bsc#1205089)
• Do not retry to import non-existing files in air-gapped mode (bsc#1204769)