| Summary: | ruby-redcloth new security issue CVE-2023-31606 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Nicolas Salguero <nicolas.salguero> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | andrewsfarm, herman.viaene, marja11, nicolas.salguero, sysadmin-bugs |
| Version: | 9 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8TOO MGA8-64-OK MGA9-64-OK | ||
| Source RPM: | ruby-RedCloth-4.3.2-7.mga9.src.rpm | CVE: | CVE-2023-31606 |
| Status comment: | |||
|
Description
Nicolas Salguero
2023-09-13 14:14:13 CEST
Nicolas Salguero
2023-09-13 14:14:30 CEST
Whiteboard:
(none) =>
MGA9TOO, MGA8TOO Once again the advisory indicates the fix in a version we already seem to have. Perhaps I am seeing something wrong.. This one is for Pascal. Status comment:
(none) =>
Fixed 4.3.2-4 ? Hi, The release number from Ubuntu is totally different from the one from Mageia so 4.3.2-4 in Ubuntu package does not mean 4.3.2-7.mga9 is newer or contains the patch for the CVE. Best regards, Nico. Status comment:
Fixed 4.3.2-4 ? =>
(none) Suggested advisory: ======================== The updated packages fix a security vulnerability: A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (CVE-2023-31606) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31606 https://ubuntu.com/security/notices/USN-6358-1 ======================== Updated packages in 9/core/updates_testing: ======================== ruby-RedCloth-4.3.2-7.1.mga9 ruby-RedCloth-doc-4.3.2-7.1.mga9 from SRPM: ruby-RedCloth-4.3.2-7.1.mga9.src.rpm Updated packages in 8/core/updates_testing: ======================== ruby-RedCloth-4.3.2-5.1.mga8 ruby-RedCloth-doc-4.3.2-5.1.mga8 from SRPM: ruby-RedCloth-4.3.2-5.1.mga8.src.rpm Version:
Cauldron =>
9 Advisory from comment 3 uploaded, please remove the "advisory" keyword if it needs to be changed CC:
(none) =>
marja11 MGA9-64 Xfce on Acer Aspire 5253 No installation issues No previous update, urmpq return nothing but itself, and reading the doc, this is a parser for use in the ruby language, developerrs stuff. So OK on clean install. CC:
(none) =>
herman.viaene MGA8-64 Plasma in Virtualbox No installation issues, so following Herman's lead and sending it on. Validating. Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0291.html Status:
ASSIGNED =>
RESOLVED |