SUSE-CU-2022:2379-1: Security update of bci/ruby

[sle-updates at lists.suse.com]

SUSE Container Update Advisory: bci/ruby
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2022:2379-1
Container Tags        : bci/ruby:2 , bci/ruby:2.5 , bci/ruby:2.5-29.38 , bci/ruby:latest
Container Release     : 29.38
Severity              : important
Type                  : security
References            : 1047178 1189802 1193081 1195773 1198752 1199140 1200800 1201680
                        1201783 1203018 CVE-2017-6512 CVE-2021-36690 CVE-2021-41819 CVE-2021-46828
                        CVE-2022-31252 CVE-2022-35737 
-----------------------------------------------------------------

The container bci/ruby was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3127-1
Released:    Wed Sep  7 04:36:10 2022
Summary:     Recommended update for libtirpc
Type:        recommended
Severity:    moderate
References:  1198752,1200800
This update for libtirpc fixes the following issues:

- Exclude ipv6 addresses in client protocol version 2 code (bsc#1200800)
- Fix memory leak in params.r_addr assignement (bsc#1198752)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3215-1
Released:    Thu Sep  8 15:58:27 2022
Summary:     Recommended update for rpm
Type:        recommended
Severity:    moderate
References:  
This update for rpm fixes the following issues:

- Support Ed25519 RPM signatures [jsc#SLE-24714]

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:3262-1
Released:    Tue Sep 13 15:34:29 2022
Summary:     Recommended update for gcc11
Type:        recommended
Severity:    moderate
References:  1199140

This update for gcc11 ships some missing 32bit libraries for s390x. (bsc#1199140)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3271-1
Released:    Wed Sep 14 06:45:39 2022
Summary:     Security update for perl
Type:        security
Severity:    moderate
References:  1047178,CVE-2017-6512
This update for perl fixes the following issues:

- CVE-2017-6512: Fixed File::Path rmtree/remove_tree race condition (bsc#1047178).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3292-1
Released:    Fri Sep 16 17:06:20 2022
Summary:     Security update for ruby2.5
Type:        security
Severity:    moderate
References:  1193081,CVE-2021-41819
This update for ruby2.5 fixes the following issues:

- CVE-2021-41819: Fixed cookie prefix spoofing in CGI::Cookie.parse (bsc#1193081).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3305-1
Released:    Mon Sep 19 11:45:57 2022
Summary:     Security update for libtirpc
Type:        security
Severity:    important
References:  1201680,CVE-2021-46828
This update for libtirpc fixes the following issues:

- CVE-2021-46828: Fixed denial of service vulnerability with lots of connections (bsc#1201680).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3307-1
Released:    Mon Sep 19 13:26:51 2022
Summary:     Security update for sqlite3
Type:        security
Severity:    moderate
References:  1189802,1195773,1201783,CVE-2021-36690,CVE-2022-35737
This update for sqlite3 fixes the following issues:

- CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783).
- CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802).
  
- Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3353-1
Released:    Fri Sep 23 15:23:40 2022
Summary:     Security update for permissions
Type:        security
Severity:    moderate
References:  1203018,CVE-2022-31252
This update for permissions fixes the following issues:

- CVE-2022-31252: Fixed chkstat group controlled paths (bsc#1203018).


The following package changes have been done:

- libtirpc-netconfig-1.2.6-150300.3.14.1 updated
- perl-base-5.26.1-150300.17.11.1 updated
- libsqlite3-0-3.39.3-150000.3.17.1 updated
- libgcc_s1-11.3.0+git1637-150000.1.11.2 updated
- libstdc++6-11.3.0+git1637-150000.1.11.2 updated
- libtirpc3-1.2.6-150300.3.14.1 updated
- permissions-20201225-150400.5.11.1 updated
- rpm-ndb-4.14.3-150300.49.1 updated
- libatomic1-11.3.0+git1637-150000.1.11.2 updated
- libgomp1-11.3.0+git1637-150000.1.11.2 updated
- libitm1-11.3.0+git1637-150000.1.11.2 updated
- liblsan0-11.3.0+git1637-150000.1.11.2 updated
- libruby2_5-2_5-2.5.9-150000.4.26.1 updated
- libtsan0-11.3.0+git1637-150000.1.11.2 updated
- ruby2.5-stdlib-2.5.9-150000.4.26.1 updated
- ruby2.5-2.5.9-150000.4.26.1 updated
- sqlite3-devel-3.39.3-150000.3.17.1 updated
- ruby2.5-devel-2.5.9-150000.4.26.1 updated
- container:sles15-image-15.0.0-27.11.27 updated