Vulnerabilities > CVE-2019-5419 - Allocation of Resources Without Limits or Throttling vulnerability in multiple products

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

Vulnerable Configurations

Part	Description	Count
Application	Rubyonrails Rubyonrails Rails 5.0.0 Rubyonrails Rails 5.0.0.1 Rubyonrails Rails 5.0.1 Rubyonrails Rails 5.0.2 Rubyonrails Rails 5.0.3 Rubyonrails Rails 5.0.4 Rubyonrails Rails 5.0.5 Rubyonrails Rails 5.0.6 Rubyonrails Rails 5.0.7 Rubyonrails Rails 5.0.7.1 Rubyonrails Rails 5.1.0 Rubyonrails Rails 5.1.1 Rubyonrails Rails 5.1.2 Rubyonrails Rails 5.1.3 Rubyonrails Rails 5.1.4 Rubyonrails Rails 5.1.5 Rubyonrails Rails 5.1.6 Rubyonrails Rails 5.1.6.1 Rubyonrails Rails 5.2.0 Rubyonrails Rails 5.2.1 Rubyonrails Rails 5.2.1.1 Rubyonrails Rails 5.2.2 Rubyonrails Rails - Rubyonrails Rails 0.9.1 Rubyonrails Rails 0.9.2 Rubyonrails Rails 0.9.3 Rubyonrails Rails 0.9.4 Rubyonrails Rails 0.9.4.1 Rubyonrails Rails 0.9.5 Rubyonrails Rails 0.10.0 Rubyonrails Rails 0.10.1 Rubyonrails Rails 0.11.0 Rubyonrails Rails 0.11.1 Rubyonrails Rails 0.12.0 Rubyonrails Rails 0.12.1 Rubyonrails Rails 0.13.0 Rubyonrails Rails 0.13.1 Rubyonrails Rails 0.14.1 Rubyonrails Rails 0.14.2 Rubyonrails Rails 0.14.3 Rubyonrails Rails 0.14.4 Rubyonrails Rails 1.0.0 Rubyonrails Rails 1.1.0 Rubyonrails Rails 1.1.1 Rubyonrails Rails 1.1.2 Rubyonrails Rails 1.1.3 Rubyonrails Rails 1.1.4 Rubyonrails Rails 1.1.5 Rubyonrails Rails 1.1.6 Rubyonrails Rails 1.2.0 Rubyonrails Rails 1.2.1 Rubyonrails Rails 1.2.2 Rubyonrails Rails 1.2.3 Rubyonrails Rails 1.2.4 Rubyonrails Rails 1.2.5 Rubyonrails Rails 1.2.6 Rubyonrails Rails 1.9.3 Rubyonrails Rails 1.9.5 Rubyonrails Rails 2.0.0 Rubyonrails Rails 2.0.1 Rubyonrails Rails 2.0.2 Rubyonrails Rails 2.0.3 Rubyonrails Rails 2.0.4 Rubyonrails Rails 2.0.5 Rubyonrails Rails 2.1.0 Rubyonrails Rails 2.1.1 Rubyonrails Rails 2.1.2 Rubyonrails Rails 2.2.0 Rubyonrails Rails 2.2.1 Rubyonrails Rails 2.2.2 Rubyonrails Rails 2.2.3 Rubyonrails Rails 2.3 Rubyonrails Rails 2.3.0 Rubyonrails Rails 2.3.1 Rubyonrails Rails 2.3.2 Rubyonrails Rails 2.3.2.1 Rubyonrails Rails 2.3.3 Rubyonrails Rails 2.3.3.1 Rubyonrails Rails 2.3.4 Rubyonrails Rails 2.3.5 Rubyonrails Rails 2.3.6 Rubyonrails Rails 2.3.7 Rubyonrails Rails 2.3.8 Rubyonrails Rails 2.3.9 Rubyonrails Rails 2.3.10 Rubyonrails Rails 2.3.11 Rubyonrails Rails 2.3.12 Rubyonrails Rails 2.3.13 Rubyonrails Rails 2.3.14 Rubyonrails Rails 2.3.15 Rubyonrails Rails 2.3.16 Rubyonrails Rails 2.3.17 Rubyonrails Rails 2.3.18 Rubyonrails Rails 3.0.0 Rubyonrails Rails 3.0.1 Rubyonrails Rails 3.0.2 Rubyonrails Rails 3.0.3 Rubyonrails Rails 3.0.4 Rubyonrails Rails 3.0.5 Rubyonrails Rails 3.0.6 Rubyonrails Rails 3.0.7 Rubyonrails Rails 3.0.8 Rubyonrails Rails 3.0.9 Rubyonrails Rails 3.0.10 Rubyonrails Rails 3.0.11 Rubyonrails Rails 3.0.12 Rubyonrails Rails 3.0.13 Rubyonrails Rails 3.0.14 Rubyonrails Rails 3.0.15 Rubyonrails Rails 3.0.16 Rubyonrails Rails 3.0.17 Rubyonrails Rails 3.0.18 Rubyonrails Rails 3.0.19 Rubyonrails Rails 3.0.20 Rubyonrails Rails 3.1.0 Rubyonrails Rails 3.1.1 Rubyonrails Rails 3.1.2 Rubyonrails Rails 3.1.3 Rubyonrails Rails 3.1.4 Rubyonrails Rails 3.1.5 Rubyonrails Rails 3.1.6 Rubyonrails Rails 3.1.7 Rubyonrails Rails 3.1.8 Rubyonrails Rails 3.1.9 Rubyonrails Rails 3.1.10 Rubyonrails Rails 3.1.11 Rubyonrails Rails 3.1.12 Rubyonrails Rails 3.2.0 Rubyonrails Rails 3.2.1 Rubyonrails Rails 3.2.2 Rubyonrails Rails 3.2.3 Rubyonrails Rails 3.2.4 Rubyonrails Rails 3.2.5 Rubyonrails Rails 3.2.6 Rubyonrails Rails 3.2.7 Rubyonrails Rails 3.2.8 Rubyonrails Rails 3.2.9 Rubyonrails Rails 3.2.10 Rubyonrails Rails 3.2.11 Rubyonrails Rails 3.2.12 Rubyonrails Rails 3.2.13 Rubyonrails Rails 3.2.14 Rubyonrails Rails 3.2.15 Rubyonrails Rails 3.2.16 Rubyonrails Rails 3.2.17 Rubyonrails Rails 3.2.18 Rubyonrails Rails 3.2.19 Rubyonrails Rails 3.2.20 Rubyonrails Rails 3.2.21 Rubyonrails Rails 3.2.22 Rubyonrails Rails 3.2.22.1 Rubyonrails Rails 3.2.22.2 Rubyonrails Rails 3.2.22.3 Rubyonrails Rails 3.2.22.4 Rubyonrails Rails 3.2.22.5 Rubyonrails Rails 4.0.0 Rubyonrails Rails 4.0.1 Rubyonrails Rails 4.0.2 Rubyonrails Rails 4.0.3 Rubyonrails Rails 4.0.4 Rubyonrails Rails 4.0.5 Rubyonrails Rails 4.0.6 Rubyonrails Rails 4.0.7 Rubyonrails Rails 4.0.8 Rubyonrails Rails 4.0.9 Rubyonrails Rails 4.0.10 Rubyonrails Rails 4.0.11 Rubyonrails Rails 4.0.11.1 Rubyonrails Rails 4.0.12 Rubyonrails Rails 4.0.13 Rubyonrails Rails 4.1.0 Rubyonrails Rails 4.1.1 Rubyonrails Rails 4.1.2 Rubyonrails Rails 4.1.3 Rubyonrails Rails 4.1.4 Rubyonrails Rails 4.1.5 Rubyonrails Rails 4.1.6 Rubyonrails Rails 4.1.7 Rubyonrails Rails 4.1.7.1 Rubyonrails Rails 4.1.8 Rubyonrails Rails 4.1.9 Rubyonrails Rails 4.1.10 Rubyonrails Rails 4.1.11 Rubyonrails Rails 4.1.12 Rubyonrails Rails 4.1.13 Rubyonrails Rails 4.1.14 Rubyonrails Rails 4.1.14.1 Rubyonrails Rails 4.1.14.2 Rubyonrails Rails 4.1.15 Rubyonrails Rails 4.1.16 Rubyonrails Rails 4.2.0 Rubyonrails Rails 4.2.1 Rubyonrails Rails 4.2.2 Rubyonrails Rails 4.2.3 Rubyonrails Rails 4.2.4 Rubyonrails Rails 4.2.5 Rubyonrails Rails 4.2.5.1 Rubyonrails Rails 4.2.5.2 Rubyonrails Rails 4.2.6 Rubyonrails Rails 4.2.7 Rubyonrails Rails 4.2.7.1 Rubyonrails Rails 4.2.8 Rubyonrails Rails 4.2.9 Rubyonrails Rails 4.2.10 Rubyonrails Rails 4.2.11	369
Application	Redhat Redhat Software Collections 1.0 Redhat Cloudforms 4.6 Redhat Cloudforms 4.7	3
OS	Debian Debian Debian Linux 8.0	1
OS	Opensuse Opensuse Leap 15.0 Opensuse Leap 15.1	2
OS	Fedoraproject Fedoraproject Fedora 30	1

Common Weakness Enumeration (CWE)

CWE-770 - Allocation of Resources Without Limits or Throttling

Common Attack Pattern Enumeration and Classification (CAPEC)

Locate and Exploit Test APIs
An attacker exploits a sample, demonstration, or test API that is insecure by default and should not be resident on production systems. Some applications include APIs that are intended to allow an administrator to test and refine their domain. These APIs should usually be disabled once a system enters a production environment. Testing APIs may expose a great deal of diagnostic information intended to aid an administrator, but which can also be used by an attacker to further refine their attack. Moreover, testing APIs may not have adequate security controls or may not have undergone rigorous testing since they were not intended for use in production environments. As such, they may have many flaws and vulnerabilities that would allow an attacker to severely disrupt a target.
Flooding
An attacker consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow control in management of interactions. Since each request consumes some of the target's resources, if a sufficiently large number of requests must be processed at the same time then the target's resources can be exhausted. The degree to which the attack is successful depends upon the volume of requests in relation to the amount of the resource the target has access to, and other mitigating circumstances such as the target's ability to shift load or acquired additional resources to deal with the depletion. The more protected the resource and the greater the quantity of it that must be consumed, the more resources the attacker may need to have at their disposal. A typical TCP/IP flooding attack is a Distributed Denial-of-Service attack where many machines simultaneously make a large number of requests to a target. Against a target with strong defenses and a large pool of resources, many tens of thousands of attacking machines may be required. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the attacker can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
Excessive Allocation
An attacker causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request. For example, using an Integer Attack, the attacker could cause a variable that controls allocation for a request to hold an excessively large value. Excessive allocation of resources can render a service degraded or unavailable to legitimate users and can even lead to crashing of the target.
XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
XML Entity Expansion
An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.

Nessus

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1824.NASL
description	This update for rmt-server to version 2.3.1 fixes the following issues : - Fix mirroring logic when errors are encountered (bsc#1140492) - Refactor RMT::Mirror to download metadata/licenses in parallel - Check repo metadata GPG signatures during mirroring (bsc#1132690) - Add rmt-server-config subpackage with nginx configs (fate#327816, bsc#1136081) - Fix dependency to removed boot_cli_i18n file (bsc#1136020) - Add `rmt-cli systems list` command to list registered systems - Fix create UUID when system_uuid file empty (bsc#1138316) - Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) - Mirror additional repos that were enabled during mirroring (bsc#1132690) - Make service IDs consistent across different RMT instances (bsc#1134428) - Make SMT data import scripts faster (bsc#1134190) - Fix incorrect triggering of registration sharing (bsc#1129392) - Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) - Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) - Allow RMT registration to work under HTTP as well as HTTPS. - Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module - Online migrations will automatically add additional modules to the client systems depending on the base product - Supply log severity to journald - Breaking Change: Added headers to generated CSV files This update was imported from the SUSE:SLE-15-SP1:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	127737
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127737
title	openSUSE Security Update : rmt-server (openSUSE-2019-1824)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2019-1824. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(127737); script_version("1.2"); script_cvs_date("Date: 2020/01/06"); script_cve_id("CVE-2019-11068", "CVE-2019-5419"); script_name(english:"openSUSE Security Update : rmt-server (openSUSE-2019-1824)"); script_summary(english:"Check for the openSUSE-2019-1824 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for rmt-server to version 2.3.1 fixes the following issues : - Fix mirroring logic when errors are encountered (bsc#1140492) - Refactor RMT::Mirror to download metadata/licenses in parallel - Check repo metadata GPG signatures during mirroring (bsc#1132690) - Add rmt-server-config subpackage with nginx configs (fate#327816, bsc#1136081) - Fix dependency to removed boot_cli_i18n file (bsc#1136020) - Add `rmt-cli systems list` command to list registered systems - Fix create UUID when system_uuid file empty (bsc#1138316) - Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) - Mirror additional repos that were enabled during mirroring (bsc#1132690) - Make service IDs consistent across different RMT instances (bsc#1134428) - Make SMT data import scripts faster (bsc#1134190) - Fix incorrect triggering of registration sharing (bsc#1129392) - Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) - Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) - Allow RMT registration to work under HTTP as well as HTTPS. - Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module - Online migrations will automatically add additional modules to the client systems depending on the base product - Supply log severity to journald - Breaking Change: Added headers to generated CSV files This update was imported from the SUSE:SLE-15-SP1:Update update project." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1128858" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1129271" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1129392" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1132160" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1132690" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1134190" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1134428" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1135222" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1136020" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1136081" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1138316" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1140492" ); script_set_attribute( attribute:"see_also", value:"https://features.opensuse.org/327816" ); script_set_attribute( attribute:"solution", value:"Update the affected rmt-server packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-11068"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:rmt-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:rmt-server-config"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:rmt-server-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:rmt-server-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:rmt-server-pubcloud"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.1"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/27"); script_set_attribute(attribute:"patch_publication_date", value:"2019/08/01"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE15\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE15.1", reference:"rmt-server-2.3.1-lp151.2.3.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"rmt-server-config-2.3.1-lp151.2.3.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"rmt-server-debuginfo-2.3.1-lp151.2.3.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"rmt-server-debugsource-2.3.1-lp151.2.3.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"rmt-server-pubcloud-2.3.1-lp151.2.3.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rmt-server / rmt-server-config / rmt-server-debuginfo / etc"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-1973-1.NASL
description	This update for rmt-server to version 2.3.1 fixes the following issues : Fix mirroring logic when errors are encountered (bsc#1140492) Refactor RMT::Mirror to download metadata/licenses in parallel Check repo metadata GPG signatures during mirroring (bsc#1132690) Add rmt-server-config subpackage with nginx configs (fate#327816, bsc#1136081) Fix dependency to removed boot_cli_i18n file (bsc#1136020) Add `rmt-cli systems list` command to list registered systems Fix create UUID when system_uuid file empty (bsc#1138316) Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) Mirror additional repos that were enabled during mirroring (bsc#1132690) Make service IDs consistent across different RMT instances (bsc#1134428) Make SMT data import scripts faster (bsc#1134190) Fix incorrect triggering of registration sharing (bsc#1129392) Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) Allow RMT registration to work under HTTP as well as HTTPS. Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module Online migrations will automatically add additional modules to the client systems depending on the base product Supply log severity to journald Breaking Change: Added headers to generated CSV files Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	127091
published	2019-07-26
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127091
title	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2019:1973-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2019:1973-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(127091); script_version("1.3"); script_cvs_date("Date: 2020/01/06"); script_cve_id("CVE-2019-11068", "CVE-2019-5419"); script_name(english:"SUSE SLES15 Security Update : rmt-server (SUSE-SU-2019:1973-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for rmt-server to version 2.3.1 fixes the following issues : Fix mirroring logic when errors are encountered (bsc#1140492) Refactor RMT::Mirror to download metadata/licenses in parallel Check repo metadata GPG signatures during mirroring (bsc#1132690) Add rmt-server-config subpackage with nginx configs (fate#327816, bsc#1136081) Fix dependency to removed boot_cli_i18n file (bsc#1136020) Add `rmt-cli systems list` command to list registered systems Fix create UUID when system_uuid file empty (bsc#1138316) Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) Mirror additional repos that were enabled during mirroring (bsc#1132690) Make service IDs consistent across different RMT instances (bsc#1134428) Make SMT data import scripts faster (bsc#1134190) Fix incorrect triggering of registration sharing (bsc#1129392) Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) Allow RMT registration to work under HTTP as well as HTTPS. Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module Online migrations will automatically add additional modules to the client systems depending on the base product Supply log severity to journald Breaking Change: Added headers to generated CSV files Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1128858" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1129271" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1129392" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1132160" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1132690" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1134190" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1134428" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1135222" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1136020" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1136081" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1138316" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1140492" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-11068/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-5419/" ); # https://www.suse.com/support/update/announcement/2019/suse-su-20191973-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?69a77979" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE Linux Enterprise Module for Server Applications 15-SP1:zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP1-2019-1973=1 SUSE Linux Enterprise Module for Public Cloud 15-SP1:zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP1-2019-1973=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-11068"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rmt-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rmt-server-config"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:rmt-server-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/27"); script_set_attribute(attribute:"patch_publication_date", value:"2019/07/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/07/26"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES15", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES15" && (! preg(pattern:"^(1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP1", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES15", sp:"1", reference:"rmt-server-2.3.1-3.3.3")) flag++; if (rpm_check(release:"SLES15", sp:"1", reference:"rmt-server-config-2.3.1-3.3.3")) flag++; if (rpm_check(release:"SLES15", sp:"1", reference:"rmt-server-debuginfo-2.3.1-3.3.3")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rmt-server"); }

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1344.NASL
description	This update for rubygem-actionpack-5_1 fixes the following issues : Security issues fixed : - CVE-2019-5418: Fixed a file content disclosure vulnerability in Action View which could be exploited via specially crafted accept headers in combination with calls to render file (bsc#1129272). - CVE-2019-5419: Fixed a resource exhaustion issue in Action View which could make the server unable to process requests (bsc#1129271). This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	124709
published	2019-05-09
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124709
title	openSUSE Security Update : rubygem-actionpack-5_1 (openSUSE-2019-1344)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1527.NASL
description	This update for rmt-server to version 2.1.4 fixes the following issues : - Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) - Mirror additional repos that were enabled during mirroring (bsc#1132690) - Make service IDs consistent across different RMT instances (bsc#1134428) - Make SMT data import scripts faster (bsc#1134190) - Fix incorrect triggering of registration sharing (bsc#1129392) - Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) - Set CURLOPT_LOW_SPEED_LIMIT to prevent downloads from getting stuck (bsc#1107806) - Truncate the RMT lockfile when writing a new PID (bsc#1125770) - Fix missing trailing slashes on custom repository import from SMT (bsc#1118745) - Zypper authentication plugin (fate#326629) - Instance verification plugin in rmt-server-pubcloud (fate#326629) - Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) - Allow RMT registration to work under HTTP as well as HTTPS. - Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module - Online migrations will automatically add additional modules to the client systems depending on the base product - Supply log severity to journald - Breaking Change: Added headers to generated CSV files This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	125794
published	2019-06-10
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125794
title	openSUSE Security Update : rmt-server (openSUSE-2019-1527)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-0796.NASL
description	An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. Security Fix(es) : * rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418) * rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : This update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	127087
published	2019-07-26
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127087
title	RHEL 7 : CloudForms (RHSA-2019:0796)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-1CFE24DB5C.NASL
description	Update Ruby on Rails to 5.2.3. Fixes CVE-2019-5418 CVE-2019-5419 CVE-2019-5420. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	124724
published	2019-05-10
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124724
title	Fedora 30 : 1:rubygem-actionmailer / 1:rubygem-actionpack / etc (2019-1cfe24db5c)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-1381-1.NASL
description	This update for rmt-server to version 2.1.4 fixes the following issues : Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222) Mirror additional repos that were enabled during mirroring (bsc#1132690) Make service IDs consistent across different RMT instances (bsc#1134428) Make SMT data import scripts faster (bsc#1134190) Fix incorrect triggering of registration sharing (bsc#1129392) Fix license mirroring issue in some non-SUSE repositories (bsc#1128858) Set CURLOPT_LOW_SPEED_LIMIT to prevent downloads from getting stuck (bsc#1107806) Truncate the RMT lockfile when writing a new PID (bsc#1125770) Fix missing trailing slashes on custom repository import from SMT (bsc#1118745) Zypper authentication plugin (fate#326629) Instance verification plugin in rmt-server-pubcloud (fate#326629) Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160) Allow RMT registration to work under HTTP as well as HTTPS. Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module Online migrations will automatically add additional modules to the client systems depending on the base product Supply log severity to journald Breaking Change: Added headers to generated CSV files Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	125620
published	2019-05-31
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125620
title	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2019:1381-1)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_1396A74A499711E9B5F183EDB3F89BA1.NASL
description	Ruby on Rails blog : Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released! These contain the following important security fixes. It is recommended that users upgrade as soon as possible : CVE-2019-5418 File Content Disclosure in Action View CVE-2019-5419 Denial of Service Vulnerability in Action View
last seen	2020-06-01
modified	2020-06-02
plugin id	122936
published	2019-03-19
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122936
title	FreeBSD : Rails -- Action View vulnerabilities (1396a74a-4997-11e9-b5f1-83edb3f89ba1)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1739.NASL
description	John Hawthorn of Github discovered a file content disclosure vulnerability in Rails, a ruby based web application framework. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. This vulnerability could also be exploited for a denial of service attack. For Debian 8
last seen	2020-06-01
modified	2020-06-02
plugin id	123526
published	2019-04-01
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123526
title	Debian DLA-1739-1 : rails security update

Redhat

advisories

rhsa
id RHSA-2019:0796
rhsa
id RHSA-2019:1147
rhsa
id RHSA-2019:1149
rhsa
id RHSA-2019:1289

rpms

ansible-tower-0:3.4.3-1.el7at
ansible-tower-server-0:3.4.3-1.el7at
ansible-tower-setup-0:3.4.3-1.el7at
ansible-tower-ui-0:3.4.3-1.el7at
ansible-tower-venv-ansible-0:3.4.3-1.el7at
ansible-tower-venv-tower-0:3.4.3-1.el7at
cfme-0:5.10.3.3-1.el7cf
cfme-amazon-smartstate-0:5.10.3.3-1.el7cf
cfme-appliance-0:5.10.3.3-1.el7cf
cfme-appliance-common-0:5.10.3.3-1.el7cf
cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf
cfme-appliance-tools-0:5.10.3.3-1.el7cf
cfme-debuginfo-0:5.10.3.3-1.el7cf
cfme-gemset-0:5.10.3.3-1.el7cf
cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf
rh-ror50-rubygem-actionpack-1:5.0.1-2.el6
rh-ror50-rubygem-actionpack-1:5.0.1-2.el7
rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6
rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
rh-ror42-rubygem-actionpack-1:4.2.6-5.el6
rh-ror42-rubygem-actionpack-1:4.2.6-5.el7
rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6
rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
cfme-0:5.9.9.3-1.el7cf
cfme-amazon-smartstate-0:5.9.9.3-1.el7cf
cfme-appliance-0:5.9.9.3-1.el7cf
cfme-appliance-common-0:5.9.9.3-1.el7cf
cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf
cfme-appliance-tools-0:5.9.9.3-1.el7cf
cfme-debuginfo-0:5.9.9.3-1.el7cf
cfme-gemset-0:5.9.9.3-1.el7cf
cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Redhat

References