OPENSUSE-SU-2026:10349-1 ruby4.0-rubygem-http-cookie-1.0.8-1.3 on GA media

These are all security issues fixed in the ruby4.0-rubygem-http-cookie-1.0.8-1.3 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10346-1 ruby4.0-rubygem-fluentd-1.17.1-1.5 on GA media

These are all security issues fixed in the ruby4.0-rubygem-fluentd-1.17.1-1.5 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10366-1 ruby4.0-rubygem-thor-1.4.0-1.3 on GA media

These are all security issues fixed in the ruby4.0-rubygem-thor-1.4.0-1.3 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10358-1 ruby4.0-rubygem-rack-3.1.18-1.3 on GA media

These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10351-1 ruby4.0-rubygem-json_pure-2.7.6-1.5 on GA media

These are all security issues fixed in the ruby4.0-rubygem-jsonpure-2.7.6-1.5 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10347-1 ruby4.0-rubygem-globalid-1.2.1-1.9 on GA media

These are all security issues fixed in the ruby4.0-rubygem-globalid-1.2.1-1.9 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10356-1 ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed...

Ruby Sinatra DoS

The vulnerability of the Ruby Sinatra web application development framework’s parser is related to the use of a regular expression c with inefficient computational complexity. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

Photon OS 4.0: Ruby PHSA-2026-4.0-0976

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0976. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

GHSA-MHG6-2Q2V-9H2C sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Summary Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardles...

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Summary Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardles...

EUVD-2026-10932

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest...

EUVD-2026-10933

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest...

Critical Photon OS Security Update - PHSA-2026-4.0-0976

Updates of 'ruby', 'ImageMagick' packages of Photon OS have been released...

CVE-2026-31830

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...

CVE-2026-31830 sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...

CVE-2026-31830 sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...

CVE-2026-31830

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...

CVE-2026-31830 sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation...

PT-2026-24484

Name of the Vulnerable Software and Affected Versions sigstore-ruby versions prior to 0.2.3 Description The software does not correctly handle verification failures when the artifact digest does not match the digest in the in-toto attestation subject. Specifically, the Sigstore::Verifierverify...