Security update for ruby-bundled-gems-rpmhelper, ruby2.5 (important)

An update that solves 21 vulnerabilities and has two fixes
is now available.

Description:

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the
following issues:

Changes in ruby2.5:

Update to 2.5.5 and 2.5.4:

https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/
https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/

Security issues fixed:

• CVE-2019-8320: Delete directory using symlink when decompressing tar
  (bsc#1130627)
• CVE-2019-8321: Escape sequence injection vulnerability in verbose
  (bsc#1130623)
• CVE-2019-8322: Escape sequence injection vulnerability in gem
  owner (bsc#1130622)
• CVE-2019-8323: Escape sequence injection vulnerability in API response
  handling (bsc#1130620)
• CVE-2019-8324: Installing a malicious gem may lead to arbitrary code
  execution (bsc#1130617)
• CVE-2019-8325: Escape sequence injection vulnerability in errors
  (bsc#1130611)

Ruby 2.5 was updated to 2.5.3:

This release includes some bug fixes and some security fixes.

Security issues fixed:

• CVE-2018-16396: Tainted flags are not propagated in Array#pack and
  String#unpack with some directives (bsc#1112532)
• CVE-2018-16395: OpenSSL::X509::Name equality check does not work
  correctly (bsc#1112530)

Ruby 2.5 was updated to 2.5.1:

This release includes some bug fixes and some security fixes.

Security issues fixed:

• CVE-2017-17742: HTTP response splitting in WEBrick (bsc#1087434)

• CVE-2018-6914: Unintentional file and directory creation with directory
  traversal in tempfile and tmpdir (bsc#1087441)

• CVE-2018-8777: DoS by large request in WEBrick (bsc#1087436)

• CVE-2018-8778: Buffer under-read in String#unpack (bsc#1087433)

• CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
  UNIXServer and UNIXSocket (bsc#1087440)

• CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in
  Dir (bsc#1087437)

• Multiple vulnerabilities in RubyGems were fixed:

  • CVE-2018-1000079: Fixed path traversal issue during gem installation
    allows to write to arbitrary filesystem locations (bsc#1082058)
  • CVE-2018-1000075: Fixed infinite loop vulnerability due to negative
    size in tar header causes Denial of Service (bsc#1082014)
  • CVE-2018-1000078: Fixed XSS vulnerability in homepage attribute when
    displayed via gem server (bsc#1082011)
  • CVE-2018-1000077: Fixed that missing URL validation on spec home
    attribute allows malicious gem to set an invalid homepage URL
    (bsc#1082010)
  • CVE-2018-1000076: Fixed improper verification of signatures in tarball
    allows to install mis-signed gem (bsc#1082009)
  • CVE-2018-1000074: Fixed unsafe Object Deserialization Vulnerability in
    gem owner allowing arbitrary code execution on specially crafted YAML
    (bsc#1082008)
  • CVE-2018-1000073: Fixed path traversal when writing to a symlinked
    basedir outside of the root (bsc#1082007)

Other changes:

• Fixed Net::POPMail methods modify frozen literal when using default arg
• ruby: change over of the Japanese Era to the new emperor May 1st 2019
  (bsc#1133790)
• build with PIE support (bsc#1130028)

Changes in ruby-bundled-gems-rpmhelper:

• Add a new helper for bundled ruby gems.

This update was imported from the SUSE:SLE-15:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.1:

  zypper in -t patch openSUSE-2019-1771=1

• openSUSE Leap 15.0:

  zypper in -t patch openSUSE-2019-1771=1