|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-1: CVE-2015-3227: rubygem-activesupport: Possible Denial of Service attack in Active Support | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Andreas Stieger <astieger> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | adrian.schroeter, astieger, jmassaguerpla, jsegitz, mrueckert, sandeep.sadanandan, tamal.nath |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | CVSSv2:RedHat:CVE-2015-3227:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:NVD:CVE-2015-3227:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: | test code | ||
|
Description
Andreas Stieger
2015-06-15 20:02:10 UTC
bugbot adjusting priority public openSUSE:13.1 rubygem-activesupport-3_2 openSUSE:13.2 rubygem-activesupport-3_2 openSUSE:Factory rubygem-activesupport-4_2 in devel project: devel:languages:ruby:extensions rubygem-activesupport-2_3 devel:languages:ruby:extensions rubygem-activesupport-3_2 devel:languages:ruby:extensions rubygem-activesupport-4_1 devel:languages:ruby:extensions rubygem-activesupport-4_2 activesupport 4.2.3 is already in Factory which contains the fix. The same for devel:languages:ruby:extensions Created attachment 640104 [details]
test code
run "ruby.ruby2.1 test2.rb"
if the version has been patched, you'll get an error of type
The document is too deep (REXML::ParseException)
This is what you expect since the default deep is 100.
With the unpatched version, you won't get any error because there is no deep checking, which is what could cause the denial of service.
This is an autogenerated message for OBS integration: This bug (934800) was mentioned in https://build.opensuse.org/request/show/315482 13.2+13.1 / rubygem-activesupport-3_2 https://build.opensuse.org/request/show/315483 13.2+13.1 / rubygem-activesupport-3_2 https://build.opensuse.org/request/show/315484 13.2+13.1 / rubygem-activesupport-3_2 openSUSE-SU-2015:1279-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934800 CVE References: CVE-2015-3227 Sources used: openSUSE 13.2 (src): rubygem-activesupport-3_2-3.2.17-2.3.1 openSUSE 13.1 (src): rubygem-activesupport-3_2-3.2.13-3.17.1 *** Bug 934875 has been marked as a duplicate of this bug. *** Sorry, I have wrongly marked another bug duplicate of this bug. Sorry for the inconvenience. SUSE-SU-2016:0047-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934800 CVE References: CVE-2015-3227 Sources used: SUSE Webyast 1.3 (src): rubygem-activesupport-3_2-3.2.12-0.14.3 SUSE Studio Onsite 1.3 (src): rubygem-activesupport-3_2-3.2.12-0.14.3 SUSE Linux Enterprise Software Development Kit 11-SP4 (src): rubygem-activesupport-3_2-3.2.12-0.14.3 SUSE Linux Enterprise Software Development Kit 11-SP3 (src): rubygem-activesupport-3_2-3.2.12-0.14.3 SUSE Lifecycle Management Server 1.3 (src): rubygem-activesupport-3_2-3.2.12-0.14.3 Releasing rubygem-activesupport-4_1 for SUSE-CLOUD-5, closing SUSE-SU-2016:0082-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 934799,934800 CVE References: CVE-2015-3226,CVE-2015-3227 Sources used: SUSE OpenStack Cloud 5 (src): rubygem-activesupport-4_1-4.1.9-9.2 |