Most recent entries from all

ALSA-2023:2652 — Important: pcs security and bug fix update

Affected: AlmaLinux:9: pcs, AlmaLinux:9: pcs-snmp

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* pcs: webpack: Regression of CVE-2023-28154 fixes in the AlmaLinux (CVE-2023-2319) * rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530) * rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697) * Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704) * [WebUI] fence levels prevent loading of cluster status (BZ#2183180)

bdu:2024-02582

BREW-travis-CVE-2023-27539 — Possible Denial of Service Vulnerability in Rack's header parsing

Affected: Homebrew: travis

There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1

# Impact Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.

# Workarounds Setting Regexp.timeout in Ruby 3.2 is a possible workaround.

EUVD-2026-209936

fkie_cve-2023-27539

There is a denial of service vulnerability in the header parsing component of Rack.

GHSA-c6qg-cjj8-47qp — Possible Denial of Service Vulnerability in Rack's header parsing

Affected: RubyGems: rack

There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1

# Workarounds Setting Regexp.timeout in Ruby 3.2 is a possible workaround.

gsd-2023-27539

openSUSE-SU-2024:12789-1 — ruby3.1-rubygem-rack-2.2-2.2.6.4-1.1 on GA media

ruby3.1-rubygem-rack-2.2-2.2.6.4-1.1 on GA media

RHSA-2023:1953 — Red Hat Security Advisory: Logging Subsystem 5.6.5 - Red Hat OpenShift security update

rubygem-rack: denial of service in header parsing rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice

SUSE-SU-2023:1685-1 — Security update for rubygem-rack

Security update for rubygem-rack

UBUNTU-CVE-2023-27539

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack

There is a denial of service vulnerability in the header parsing component of Rack.

WID-SEC-W-2023-0632 — Ruby on Rails: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, unbekannte Auswirkungen zu verursachen oder einen Denial of Service Zustand herbeizuführen.