Security update for ruby2.5
This update for ruby2.5 fixes the following issues: - CVE-2024-43398: Fixed DoS when parsing a XML that has many deep elements with the same local name attributes (bsc#1229673) - CVE-2024-41123: Fixed DoS when parsing an XML that contains many specific characters such as whitespaces, >] and ]> (bsc#1228794) - CVE-2024-41946: Fixed DoS when parsing an XML that has many entity expansions with SAX2 or pull parser API (bsc#1228799) - CVE-2024-35176: Fixed DoS when parsing an XML that has many left angled brackets in an attribute value (bsc#1224390) - CVE-2024-39908: Fixed ReDos when parsing an XML that has many specific characters (bsc#1228072)
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for ruby2.5 fixes the following issues: - CVE-2024-43398: Fixed DoS when parsing a XML that has many deep elements with the same local name attributes (bsc#1229673) - CVE-2024-41123: Fixed DoS when parsing an XML that contains many specific characters such as whitespaces, >] and ]> (bsc#1228794) - CVE-2024-41946: Fixed DoS when parsing an XML that has many entity expansions with SAX2 or pull parser API (bsc#1228799) - CVE-2024-35176: Fixed DoS when parsing an XML that has many left angled brackets in an attribute value (bsc#1224390) - CVE-2024-39908: Fixed ReDos when parsing an XML that has many specific characters (bsc#1228072)
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1224390
- https://bugzilla.suse.com/1228072
- https://bugzilla.suse.com/1228794
- https://bugzilla.suse.com/1228799
- https://bugzilla.suse.com/1229673
- https://www.suse.com/security/cve/CVE-2024-35176
- https://www.suse.com/security/cve/CVE-2024-39908
- https://www.suse.com/security/cve/CVE-2024-41123
- https://www.suse.com/security/cve/CVE-2024-41946
- https://www.suse.com/security/cve/CVE-2024-43398
- https://www.suse.com/support/update/announcement/2024/suse-su-20243874-1/