Security update for SUSE Studio SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0863-1 Final 1 1 2015-05-05T23:49:58Z current 2015-05-05T23:49:58Z 2015-05-05T23:49:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Studio This update provides SUSE Studio 1.3.10, including Amazon's EC2 support for SUSE Linux Enterprise 12 appliances. Additionally, the update includes fixes for the following issues: * #904372 - Arbitrary file existence disclosure in sprockets gem (CVE-2014-7819) * #904375 - Arbitrary file existence disclosure in Action Pack gem (CVE-2014-7818) * #918203 - Arbitrary file existence disclosure in Studio Onsite (CVE-2014-7829) * #852794 - SLES 11-SP3 templates fail to build x86_64 EC2 images * #914765 - Change of appliance name is not displayed in appliance's change log * #887893 - Change log not accessible via API * #918239 - Failure to create new appliances after upgrade to Studio Onsite 1.3.9 * #918395 - Remove 32bit as target for building EC2 appliances * #912512 - Studio doesn't allow duplicated repositories * #880078 - Studio packages contain files that get modified (by Studio) after installation. * #919037 - Can't open appliance on Gallery: undefined restructure_unsupportable_packages method. Security Issues: * CVE-2014-7819 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819> * CVE-2014-7818 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818> * CVE-2014-7829 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slestso13-susestudio-1310-201502 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150863-1/ Link for SUSE-SU-2015:0863-1 https://lists.suse.com/pipermail/sle-security-updates/2015-May/001377.html E-Mail link for SUSE-SU-2015:0863-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/852794 SUSE Bug 852794 https://bugzilla.suse.com/876313 SUSE Bug 876313 https://bugzilla.suse.com/880078 SUSE Bug 880078 https://bugzilla.suse.com/887893 SUSE Bug 887893 https://bugzilla.suse.com/904372 SUSE Bug 904372 https://bugzilla.suse.com/904375 SUSE Bug 904375 https://bugzilla.suse.com/912512 SUSE Bug 912512 https://bugzilla.suse.com/914765 SUSE Bug 914765 https://bugzilla.suse.com/918203 SUSE Bug 918203 https://bugzilla.suse.com/918239 SUSE Bug 918239 https://bugzilla.suse.com/918395 SUSE Bug 918395 https://bugzilla.suse.com/919037 SUSE Bug 919037 https://www.suse.com/security/cve/CVE-2014-7818/ SUSE CVE CVE-2014-7818 page https://www.suse.com/security/cve/CVE-2014-7819/ SUSE CVE CVE-2014-7819 page https://www.suse.com/security/cve/CVE-2014-7829/ SUSE CVE CVE-2014-7829 page SUSE Studio Onsite 1.3 Containment-Studio-SLE11_SP3-5.05.81-20150505234825 susestudio-1.3.10-0.17.45 susestudio-bundled-packages-1.3.10-0.17.45 susestudio-common-1.3.10-0.17.45 susestudio-runner-1.3.10-0.17.45 susestudio-sid-1.3.10-0.17.45 susestudio-ui-server-1.3.10-0.17.45 Containment-Studio-SLE11_SP3-5.05.81-20150505234825 as a component of SUSE Studio Onsite 1.3 susestudio-1.3.10-0.17.45 as a component of SUSE Studio Onsite 1.3 susestudio-bundled-packages-1.3.10-0.17.45 as a component of SUSE Studio Onsite 1.3 susestudio-common-1.3.10-0.17.45 as a component of SUSE Studio Onsite 1.3 susestudio-runner-1.3.10-0.17.45 as a component of SUSE Studio Onsite 1.3 susestudio-sid-1.3.10-0.17.45 as a component of SUSE Studio Onsite 1.3 susestudio-ui-server-1.3.10-0.17.45 as a component of SUSE Studio Onsite 1.3 Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence. CVE-2014-7818 SUSE Studio Onsite 1.3:Containment-Studio-SLE11_SP3-5.05.81-20150505234825 SUSE Studio Onsite 1.3:susestudio-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-bundled-packages-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-common-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-runner-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-sid-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-ui-server-1.3.10-0.17.45 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150863-1/ https://www.suse.com/security/cve/CVE-2014-7818.html CVE-2014-7818 https://bugzilla.suse.com/903662 SUSE Bug 903662 https://bugzilla.suse.com/905727 SUSE Bug 905727 Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding. CVE-2014-7819 SUSE Studio Onsite 1.3:Containment-Studio-SLE11_SP3-5.05.81-20150505234825 SUSE Studio Onsite 1.3:susestudio-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-bundled-packages-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-common-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-runner-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-sid-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-ui-server-1.3.10-0.17.45 low 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150863-1/ https://www.suse.com/security/cve/CVE-2014-7819.html CVE-2014-7819 https://bugzilla.suse.com/903658 SUSE Bug 903658 Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818. CVE-2014-7829 SUSE Studio Onsite 1.3:Containment-Studio-SLE11_SP3-5.05.81-20150505234825 SUSE Studio Onsite 1.3:susestudio-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-bundled-packages-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-common-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-runner-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-sid-1.3.10-0.17.45 SUSE Studio Onsite 1.3:susestudio-ui-server-1.3.10-0.17.45 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150863-1/ https://www.suse.com/security/cve/CVE-2014-7829.html CVE-2014-7829 https://bugzilla.suse.com/905727 SUSE Bug 905727