suse-su-2016:1146-1
Vulnerability from csaf_suse
Published
2016-04-25 14:28
Modified
2016-04-25 14:28
Summary
Security update for portus

Notes

Title of the patch
Security update for portus
Description of the patch
Portus was updated to version 2.0.3, which brings several fixes and enhancements: - Fixed crono job when a repository could not be found. - Fixed compatibility issues with Docker 1.10 and Distribution 2.3. - Handle multiple scopes in token requests. - Add optional fields to token response. - Fixed notification events for Distribution v2.3. - Paginate through the catalog properly. - Do not remove all the repositories if fetching one fails. - Fixed SMTP setup. - Don't let crono overflow the 'log' column on the DB. - Show the actual LDAP error on invalid login. - Fixed the location of crono logs. - Always use relative paths. - Set RUBYLIB when using portusctl. - Don't count hidden teams on the admin panel. - Warn developers on unsupported docker-compose versions. - Directly invalidate LDAP logins without name and password. - Don't show the 'I forgot my password' link on LDAP. The following Rubygems bundled within Portus have been updated to fix security issues: - CVE-2016-2098: rubygem-actionpack (bsc#969943). - CVE-2015-7578: rails-html-sanitizer (bsc#963326). - CVE-2015-7579: rails-html-sanitizer (bsc#963327). - CVE-2015-7580: rails-html-sanitizer (bsc#963328). - CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563). - CVE-2015-7577: rubygem-activerecord (bsc#963604). - CVE-2016-0751: rugygem-actionpack (bsc#963627). - CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608). - CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617). - CVE-2015-7581: rubygem-actionpack (bsc#963625).
Patchnames
SUSE-SLE-Module-Containers-12-2016-672
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for portus",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nPortus was updated to version 2.0.3, which brings several fixes and enhancements:\n\n- Fixed crono job when a repository could not be found.\n- Fixed compatibility issues with Docker 1.10 and Distribution 2.3.\n- Handle multiple scopes in token requests.\n- Add optional fields to token response.\n- Fixed notification events for Distribution v2.3.\n- Paginate through the catalog properly.\n- Do not remove all the repositories if fetching one fails.\n- Fixed SMTP setup.\n- Don\u0027t let crono overflow the \u0027log\u0027 column on the DB.\n- Show the actual LDAP error on invalid login.\n- Fixed the location of crono logs.\n- Always use relative paths.\n- Set RUBYLIB when using portusctl.\n- Don\u0027t count hidden teams on the admin panel.\n- Warn developers on unsupported docker-compose versions.\n- Directly invalidate LDAP logins without name and password.\n- Don\u0027t show the \u0027I forgot my password\u0027 link on LDAP.\n\nThe following Rubygems bundled within Portus have been updated to fix security\nissues:\n\n- CVE-2016-2098: rubygem-actionpack (bsc#969943).\n- CVE-2015-7578: rails-html-sanitizer (bsc#963326).\n- CVE-2015-7579: rails-html-sanitizer (bsc#963327).\n- CVE-2015-7580: rails-html-sanitizer (bsc#963328).\n- CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).\n- CVE-2015-7577: rubygem-activerecord (bsc#963604).\n- CVE-2016-0751: rugygem-actionpack (bsc#963627).\n- CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).\n- CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).\n- CVE-2015-7581: rubygem-actionpack (bsc#963625).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Module-Containers-12-2016-672",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_1146-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2016:1146-1",
        "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2016:1146-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2016-April/002027.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963326",
        "url": "https://bugzilla.suse.com/963326"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963327",
        "url": "https://bugzilla.suse.com/963327"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963328",
        "url": "https://bugzilla.suse.com/963328"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963563",
        "url": "https://bugzilla.suse.com/963563"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963604",
        "url": "https://bugzilla.suse.com/963604"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963608",
        "url": "https://bugzilla.suse.com/963608"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963617",
        "url": "https://bugzilla.suse.com/963617"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963625",
        "url": "https://bugzilla.suse.com/963625"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 963627",
        "url": "https://bugzilla.suse.com/963627"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 969943",
        "url": "https://bugzilla.suse.com/969943"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7576 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7576/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7577 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7577/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7578 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7578/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7579 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7579/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7580 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7580/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7581 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7581/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-0751 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-0751/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-0752 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-0752/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-0753 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-0753/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2098 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2098/"
      }
    ],
    "title": "Security update for portus",
    "tracking": {
      "current_release_date": "2016-04-25T14:28:51Z",
      "generator": {
        "date": "2016-04-25T14:28:51Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2016:1146-1",
      "initial_release_date": "2016-04-25T14:28:51Z",
      "revision_history": [
        {
          "date": "2016-04-25T14:28:51Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "portus-2.0.3-2.4.x86_64",
                "product": {
                  "name": "portus-2.0.3-2.4.x86_64",
                  "product_id": "portus-2.0.3-2.4.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Containers 12",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Containers 12",
                  "product_id": "SUSE Linux Enterprise Module for Containers 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-containers:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "portus-2.0.3-2.4.x86_64 as component of SUSE Linux Enterprise Module for Containers 12",
          "product_id": "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        },
        "product_reference": "portus-2.0.3-2.4.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7576",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7576"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7576",
          "url": "https://www.suse.com/security/cve/CVE-2015-7576"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963329 for CVE-2015-7576",
          "url": "https://bugzilla.suse.com/963329"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963563 for CVE-2015-7576",
          "url": "https://bugzilla.suse.com/963563"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 970715 for CVE-2015-7576",
          "url": "https://bugzilla.suse.com/970715"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-7576"
    },
    {
      "cve": "CVE-2015-7577",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7577"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7577",
          "url": "https://www.suse.com/security/cve/CVE-2015-7577"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963330 for CVE-2015-7577",
          "url": "https://bugzilla.suse.com/963330"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963604 for CVE-2015-7577",
          "url": "https://bugzilla.suse.com/963604"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-7577"
    },
    {
      "cve": "CVE-2015-7578",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7578"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7578",
          "url": "https://www.suse.com/security/cve/CVE-2015-7578"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963326 for CVE-2015-7578",
          "url": "https://bugzilla.suse.com/963326"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-7578"
    },
    {
      "cve": "CVE-2015-7579",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7579"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7579",
          "url": "https://www.suse.com/security/cve/CVE-2015-7579"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963326 for CVE-2015-7579",
          "url": "https://bugzilla.suse.com/963326"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963327 for CVE-2015-7579",
          "url": "https://bugzilla.suse.com/963327"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963328 for CVE-2015-7579",
          "url": "https://bugzilla.suse.com/963328"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-7579"
    },
    {
      "cve": "CVE-2015-7580",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7580"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7580",
          "url": "https://www.suse.com/security/cve/CVE-2015-7580"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963326 for CVE-2015-7580",
          "url": "https://bugzilla.suse.com/963326"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963327 for CVE-2015-7580",
          "url": "https://bugzilla.suse.com/963327"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963328 for CVE-2015-7580",
          "url": "https://bugzilla.suse.com/963328"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-7580"
    },
    {
      "cve": "CVE-2015-7581",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7581"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application\u0027s use of a wildcard controller route.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7581",
          "url": "https://www.suse.com/security/cve/CVE-2015-7581"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963335 for CVE-2015-7581",
          "url": "https://bugzilla.suse.com/963335"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-7581"
    },
    {
      "cve": "CVE-2016-0751",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-0751"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-0751",
          "url": "https://www.suse.com/security/cve/CVE-2016-0751"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963331 for CVE-2016-0751",
          "url": "https://bugzilla.suse.com/963331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963627 for CVE-2016-0751",
          "url": "https://bugzilla.suse.com/963627"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-0751"
    },
    {
      "cve": "CVE-2016-0752",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-0752"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application\u0027s unrestricted use of the render method and providing a .. (dot dot) in a pathname.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-0752",
          "url": "https://www.suse.com/security/cve/CVE-2016-0752"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963332 for CVE-2016-0752",
          "url": "https://bugzilla.suse.com/963332"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963608 for CVE-2016-0752",
          "url": "https://bugzilla.suse.com/963608"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 968850 for CVE-2016-0752",
          "url": "https://bugzilla.suse.com/968850"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-0752"
    },
    {
      "cve": "CVE-2016-0753",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-0753"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-0753",
          "url": "https://www.suse.com/security/cve/CVE-2016-0753"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963334 for CVE-2016-0753",
          "url": "https://bugzilla.suse.com/963334"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 963617 for CVE-2016-0753",
          "url": "https://bugzilla.suse.com/963617"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-0753"
    },
    {
      "cve": "CVE-2016-2098",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2098"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application\u0027s unrestricted use of the render method.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2098",
          "url": "https://www.suse.com/security/cve/CVE-2016-2098"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 968849 for CVE-2016-2098",
          "url": "https://bugzilla.suse.com/968849"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 969943 for CVE-2016-2098",
          "url": "https://bugzilla.suse.com/969943"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 993313 for CVE-2016-2098",
          "url": "https://bugzilla.suse.com/993313"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Containers 12:portus-2.0.3-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-04-25T14:28:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-2098"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.