Bugzilla – Bug 1214807
VUL-0: CVE-2023-38037: rubygem-activesupport-5.2: File Disclosure of Locally Encrypted Files
Last modified: 2024-05-29 12:06:33 UTC
CVE-2023-38037 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2023-38037.yml http://localhost:5600/static/#/asm_ticket/98986 CVE(s): CVE-2023-38037 There is a possible file disclosure of locally encrypted files in Active Support. Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 # Impact ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file. Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it. All users running an affected release should either upgrade or use one of the workarounds immediately. # Releases The fixed releases are available at the normal locations. # Workarounds To work around this issue, you can set your umask to be more restrictive like this: ```ruby $ umask 0077 ``` References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38037 https://bugzilla.redhat.com/show_bug.cgi?id=2236261
relevant for: openSUSE:Factory/rubygem-activesupport-7.0 openSUSE:Backports:SLE-15-SP5/rubygem-activesupport-5.2 openSUSE:Backports:SLE-15-SP6/rubygem-activesupport-5.2
b15sp5: https://build.opensuse.org/request/show/1117600 https://build.opensuse.org/request/show/1117601
b15sp5 https://build.opensuse.org/request/show/1117638 https://build.opensuse.org/request/show/1117639 b15sp6 https://build.opensuse.org/request/show/1117642 https://build.opensuse.org/request/show/1117643
b15sp5 submitted, b15sp6 declined because Factory first. I believe all fixed, except 15sp6 and Tubmleweed. Let's let maintainers decide what to do for Factory and 15sp6.
openSUSE-RU-2023:0349-1: An update that fixes one vulnerability is now available. Category: recommended (low) Bug References: 1214807 CVE References: CVE-2023-38037 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): rubygem-railties-5.2-5.2.3-bp155.3.3.1
openSUSE-SU-2023:0350-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1214807 CVE References: CVE-2023-38037 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): rubygem-activesupport-5.2-5.2.3-bp155.3.5.1
Factory has 7.0.8, thus fixed there.
15sp6 https://build.opensuse.org/request/show/1130752
All done, closing.