SUSE-CU-2025:1359-1: Security update of bci/ruby
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Thu Feb 27 08:18:35 UTC 2025
SUSE Container Update Advisory: bci/ruby
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2025:1359-1
Container Tags : bci/ruby:2 , bci/ruby:2.5 , bci/ruby:2.5-31.35 , bci/ruby:latest
Container Release : 31.35
Severity : important
Type : security
References : 1230930 1232440 CVE-2024-47220 CVE-2024-49761
-----------------------------------------------------------------
The container bci/ruby was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:736-1
Released: Wed Feb 26 19:38:12 2025
Summary: Security update for ruby2.5
Type: security
Severity: important
References: 1230930,1232440,CVE-2024-47220,CVE-2024-49761
This update for ruby2.5 fixes the following issues:
- CVE-2024-47220: Fixed a HTTP request smuggling attack in WEBrick (bsc#1230930)
- CVE-2024-49761: Fixed a ReDoS vulnerability in ruby rexml (bsc#1232440)
Other fixes:
- [ruby/uri] Fix quadratic backtracking on invalid relative URI
- [ruby/time] Make RFC2822 regexp linear
- [ruby/time] Fix quadratic backtracking on invalid time
- merge some parts of CGI 0.1.1
The following package changes have been done:
- libruby2_5-2_5-2.5.9-150000.4.36.1 updated
- ruby2.5-stdlib-2.5.9-150000.4.36.1 updated
- ruby2.5-2.5.9-150000.4.36.1 updated
- ruby2.5-devel-2.5.9-150000.4.36.1 updated
More information about the sle-container-updates
mailing list