SUSE-CU-2022:862-1: Security update of bci/ruby

[sle-updates at lists.suse.com]

SUSE Container Update Advisory: bci/ruby
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2022:862-1
Container Tags        : bci/ruby:2 , bci/ruby:2.5 , bci/ruby:2.5-17.7 , bci/ruby:latest
Container Release     : 17.7
Severity              : important
Type                  : security
References            : 1188160 1188161 1190375 1193035 1198441 CVE-2021-31799 CVE-2021-31810
                        CVE-2021-32066 CVE-2021-41817 CVE-2022-28739 
-----------------------------------------------------------------

The container bci/ruby was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:1512-1
Released:    Tue May  3 16:11:28 2022
Summary:     Security update for ruby2.5
Type:        security
Severity:    important
References:  1188160,1188161,1190375,1193035,1198441,CVE-2021-31799,CVE-2021-31810,CVE-2021-32066,CVE-2021-41817,CVE-2022-28739
This update for ruby2.5 fixes the following issues:

- CVE-2022-28739: Fixed a buffer overrun in String-to-Float conversion (bsc#1198441).
- CVE-2021-41817: Fixed a regular expression denial of service in Date Parsing Methods (bsc#1193035).
- CVE-2021-32066: Fixed a StartTLS stripping vulnerability in Net:IMAP (bsc#1188160).
- CVE-2021-31810: Fixed a trusting FTP PASV responses vulnerability in Net:FTP (bsc#1188161).
- CVE-2021-31799: Fixed a command injection vulnerability in RDoc (bsc#1190375). 


The following package changes have been done:

- libruby2_5-2_5-2.5.9-150000.4.23.1 updated
- ruby2.5-devel-2.5.9-150000.4.23.1 updated
- ruby2.5-stdlib-2.5.9-150000.4.23.1 updated
- ruby2.5-2.5.9-150000.4.23.1 updated