Security update for ruby
This update for ruby fixes the following issues: - CVE-2018-16395: Fixed an issue where two x509 certificates could be considered to be equal when this was not the case (bsc#1112530). - CVE-2021-32066: Fixed an issue where the IMAP client API would not report a failure when StartTLS failed, leading to potential man in the middle attacks (bsc#1188160). - CVE-2021-31810: Fixed an issue where the FTP client API would trust certain responses from a malicious server, tricking the client into connecting to addresses not (bsc#1188161).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for ruby fixes the following issues: - CVE-2018-16395: Fixed an issue where two x509 certificates could be considered to be equal when this was not the case (bsc#1112530). - CVE-2021-32066: Fixed an issue where the IMAP client API would not report a failure when StartTLS failed, leading to potential man in the middle attacks (bsc#1188160). - CVE-2021-31810: Fixed an issue where the FTP client API would trust certain responses from a malicious server, tricking the client into connecting to addresses not (bsc#1188161).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1112530
- https://bugzilla.suse.com/1188160
- https://bugzilla.suse.com/1188161
- https://www.suse.com/security/cve/CVE-2018-16395
- https://www.suse.com/security/cve/CVE-2021-31810
- https://www.suse.com/security/cve/CVE-2021-32066
- https://www.suse.com/security/cve/CVE-2021-81810
- https://www.suse.com/support/update/announcement/2022/suse-su-202215034-1/