Description
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| http://haml.info/ | haml | All versions prior to version 5.0.0.beta.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-haml | 5.0.4-1 | — |
| Debian 13 | ruby-haml | 5.0.4-1 | — |
| Debian 12 | ruby-haml | 5.0.4-1 | — |
| Debian 9 | ruby-haml | 4.0.7-1+deb9u1 | DLA-2864-1 |
| Debian 8 | ruby-haml | 4.0.5-2+deb8u1 | DLA-1986-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ruby-haml | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-haml | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | ruby-haml | 4.0.5-2+deb8u1build0.14.04.1~esm1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | rubygem-haml | 4.0.6-3.3.1 | SUSE-SU-2019:2932-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-core | 5.0+git.1582968668.1a55c77c5-3.35.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-ha | 5.0+git.1574286229.e0364c3-3.29.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-openstack | 5.0+git.1582911795.5081ef1da-4.34.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | crowbar-ui | 1.2.0+git.1575896697.a01a3a08-3.15.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | keepalived | 2.0.19-3.6.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | mariadb | 10.2.31-4.17.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-cinder | 11.2.3~dev23-3.24.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-cinder-doc | 11.2.3~dev23-3.24.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-dashboard | 12.0.5~dev2-3.23.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-dashboard-theme-SUSE | 2017.2+git.1573629528.6b21fa5-7.14.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat | 9.0.8~dev22-3.27.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-doc | 9.0.8~dev22-3.27.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-templates | 0.0.0+git.1560033670.e3b5a52-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-designate-ui | 5.0.3~dev2-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-horizon-plugin-neutron-lbaas-ui | 3.0.3~dev5-3.14.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-ironic | 9.1.8~dev8-3.24.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-ironic-doc | 9.1.8~dev8-3.24.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-keystone | 12.0.4~dev5-5.30.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-keystone-doc | 12.0.4~dev5-5.30.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-agent | 2.2.5~dev5-3.15.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron | 11.0.9~dev60-3.27.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-doc | 11.0.9~dev60-3.27.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-gbp | 7.3.1~dev72-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-vsphere | 2.0.1~dev133-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova | 16.1.9~dev49-3.32.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-nova-doc | 16.1.9~dev49-3.32.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-octavia | 1.0.6~dev3-4.21.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-octavia-amphora-image | 0.1.2-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-resource-agents | 1.0+git.1569436425.8b9c49f-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-sahara | 7.0.5~dev4-3.12.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-sahara-doc | 7.0.5~dev4-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-trove +1 | 8.0.2~dev2-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-congressclient | 1.8.1-3.3.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-designateclient | 2.7.1-3.3.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-freezegun | 0.3.9-1.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-ironic-lib | 2.10.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-networking-cisco | 6.1.1~dev65-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-osc-lib | 1.7.1-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-oslo.context | 2.17.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-oslo.rootwrap | 5.9.3-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-oslo.serialization | 2.20.3-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-stevedore +1 | 1.25.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-taskflow | 2.14.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-crowbar-client | 3.9.1-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-haml | 4.0.6-3.3.1 | SUSE-SU-2019:2932-1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-puma | 2.16.0-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-cinder | 8.0+git.1579279939.ee7da88-3.39.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-cobbler | 8.0+git.1575037115.0326803-3.41.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-designate | 8.0+git.1573597788.15b7984-3.17.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-extensions-example | 8.0+git.1534266307.db1ec28-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-extensions-nsx | 8.0+git.1567529036.a41a037-3.6.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-glance | 8.0+git.1571846045.ab9e3ea-3.20.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-heat | 8.0+git.1571777596.14dce6a-3.15.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-input-model | 8.0+git.1582147997.b9ed134-3.36.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-ironic | 8.0+git.1571845225.006843d-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-keystone | 8.0+git.1573147067.09e3ea0-3.27.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-logging | 8.0+git.1572452293.e65d714-3.21.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-monasca | 8.0+git.1572527728.9b34bdf-3.21.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-monasca-transform | 8.0+git.1571845965.97714fb-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-mq | 8.0+git.1581024906.fbf0be3-3.16.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-neutron | 8.0+git.1573050365.ff6fa06-3.36.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-nova | 8.0+git.1571846125.584d988-3.38.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-octavia | 8.0+git.1575642049.1f321d0-3.23.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-osconfig | 8.0+git.1581015942.2d21e63-3.42.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | ardana-tempest | 8.0+git.1579261264.7dd213a-3.30.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | keepalived | 2.0.19-3.6.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | mariadb | 10.2.31-4.17.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-cinder | 11.2.3~dev23-3.24.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-cinder-doc | 11.2.3~dev23-3.24.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-dashboard | 12.0.5~dev2-3.23.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-dashboard-theme-SUSE | 2017.2+git.1573629528.6b21fa5-7.14.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-heat | 9.0.8~dev22-3.27.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-heat-doc | 9.0.8~dev22-3.27.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-heat-templates | 0.0.0+git.1560033670.e3b5a52-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-designate-ui | 5.0.3~dev2-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-horizon-plugin-neutron-lbaas-ui | 3.0.3~dev5-3.14.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-ironic | 9.1.8~dev8-3.24.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-ironic-doc | 9.1.8~dev8-3.24.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-keystone | 12.0.4~dev5-5.30.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-keystone-doc | 12.0.4~dev5-5.30.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-agent | 2.2.5~dev5-3.15.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-neutron | 11.0.9~dev60-3.27.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-neutron-doc | 11.0.9~dev60-3.27.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-neutron-gbp | 7.3.1~dev72-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-neutron-vsphere | 2.0.1~dev133-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-nova | 16.1.9~dev49-3.32.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-nova-doc | 16.1.9~dev49-3.32.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-octavia | 1.0.6~dev3-4.21.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-octavia-amphora-image | 0.1.2-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-resource-agents | 1.0+git.1569436425.8b9c49f-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-sahara | 7.0.5~dev4-3.12.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-sahara-doc | 7.0.5~dev4-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | openstack-trove +1 | 8.0.2~dev2-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-cinderlm | 0.0.2+git.1571845893.27f0b7b-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-congressclient | 1.8.1-3.3.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-designateclient | 2.7.1-3.3.4 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-freezegun | 0.3.9-1.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-ironic-lib | 2.10.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-networking-cisco | 6.1.1~dev65-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-osc-lib | 1.7.1-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-oslo.context | 2.17.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-oslo.rootwrap | 5.9.3-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-oslo.serialization | 2.20.3-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-stevedore +1 | 1.25.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | python-taskflow | 2.14.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-aodh | 5.1.1~dev7-12.22.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.2~dev3-12.23.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.20.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-cinder | 11.2.3~dev23-14.23.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.3~dev7-12.21.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.18.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-glance | 15.0.3~dev3-12.21.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.23.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev2-14.28.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-ironic | 9.1.8~dev8-12.23.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-keystone | 12.0.4~dev5-11.24.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.22.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-manila | 5.1.1~dev2-12.25.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca | 2.2.2~dev1-11.20.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.18.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-murano | 4.0.2~dev2-12.18.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-neutron | 11.0.9~dev60-13.26.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-nova | 16.1.9~dev49-11.24.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.6~dev3-12.23.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.5~dev4-11.22.2 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.16.3 | SUSE-SU-2020:0640-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-trove | 8.0.2~dev2-11.22.2 | SUSE-SU-2020:0640-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | caasp-openstack-heat-templates | 1.0+git.1560518045.ad7dc6d-1.9.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | crowbar-core | 4.0+git.1573109906.0f62e9503-9.57.2 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | crowbar-openstack | 4.0+git.1573038068.1e32b3205-9.62.2 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | crowbar-ui | 1.1.0+git.1547500033.d0fb2bf2-4.12.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | galera-3 | 25.3.25-11.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | mariadb | 10.2.25-13.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | mariadb-connector-c | 3.1.2-1.9.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | openstack-dashboard-theme-SUSE | 2016.2-5.9.2 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | openstack-heat-templates | 0.0.0+git.1515995585.81ed236-12.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | openstack-neutron | 9.4.2~dev21-7.35.3 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | openstack-neutron-doc | 9.4.2~dev21-7.35.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | openstack-nova | 14.0.11~dev13-4.37.3 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | openstack-nova-doc | 14.0.11~dev13-4.37.2 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | patterns-cloud | 20170124-4.6.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | python-oslo.messaging | 5.10.2-3.12.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | python-oslo.utils | 3.16.1-3.6.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | python-pysaml2 | 4.0.2-3.14.1 | SUSE-SU-2019:3270-1 |
| SUSE OpenStack Cloud 7 | rubygem-haml | 4.0.6-3.3.1 | SUSE-SU-2019:2932-1 |
| SUSE HPE Helion OpenStack 8 | ardana-cinder | 8.0+git.1579279939.ee7da88-3.39.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-cobbler | 8.0+git.1575037115.0326803-3.41.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-designate | 8.0+git.1573597788.15b7984-3.17.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-extensions-example | 8.0+git.1534266307.db1ec28-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-extensions-nsx | 8.0+git.1567529036.a41a037-3.6.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-glance | 8.0+git.1571846045.ab9e3ea-3.20.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-heat | 8.0+git.1571777596.14dce6a-3.15.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-input-model | 8.0+git.1582147997.b9ed134-3.36.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-ironic | 8.0+git.1571845225.006843d-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-keystone | 8.0+git.1573147067.09e3ea0-3.27.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-logging | 8.0+git.1572452293.e65d714-3.21.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-monasca | 8.0+git.1572527728.9b34bdf-3.21.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-monasca-transform | 8.0+git.1571845965.97714fb-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-mq | 8.0+git.1581024906.fbf0be3-3.16.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-neutron | 8.0+git.1573050365.ff6fa06-3.36.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-nova | 8.0+git.1571846125.584d988-3.38.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-octavia | 8.0+git.1575642049.1f321d0-3.23.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-osconfig | 8.0+git.1581015942.2d21e63-3.42.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | ardana-tempest | 8.0+git.1579261264.7dd213a-3.30.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | keepalived | 2.0.19-3.6.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | mariadb | 10.2.31-4.17.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-cinder | 11.2.3~dev23-3.24.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-cinder-doc | 11.2.3~dev23-3.24.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-dashboard | 12.0.5~dev2-3.23.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-heat | 9.0.8~dev22-3.27.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-doc | 9.0.8~dev22-3.27.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-templates | 0.0.0+git.1560033670.e3b5a52-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-designate-ui | 5.0.3~dev2-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-horizon-plugin-neutron-lbaas-ui | 3.0.3~dev5-3.14.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-ironic | 9.1.8~dev8-3.24.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-ironic-doc | 9.1.8~dev8-3.24.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-keystone | 12.0.4~dev5-5.30.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-keystone-doc | 12.0.4~dev5-5.30.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-agent | 2.2.5~dev5-3.15.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron | 11.0.9~dev60-3.27.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-doc | 11.0.9~dev60-3.27.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-gbp | 7.3.1~dev72-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-vsphere | 2.0.1~dev133-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-nova | 16.1.9~dev49-3.32.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-nova-doc | 16.1.9~dev49-3.32.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-octavia | 1.0.6~dev3-4.21.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-octavia-amphora-image | 0.1.2-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-resource-agents | 1.0+git.1569436425.8b9c49f-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-sahara | 7.0.5~dev4-3.12.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-sahara-doc | 7.0.5~dev4-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | openstack-trove +1 | 8.0.2~dev2-3.12.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-cinderlm | 0.0.2+git.1571845893.27f0b7b-3.9.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-congressclient | 1.8.1-3.3.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-designateclient | 2.7.1-3.3.4 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-ironic-lib | 2.10.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-networking-cisco | 6.1.1~dev65-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-osc-lib | 1.7.1-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-oslo.context | 2.17.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-oslo.rootwrap | 5.9.3-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-oslo.serialization | 2.20.3-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-stevedore +1 | 1.25.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | python-taskflow | 2.14.2-3.3.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-aodh | 5.1.1~dev7-12.22.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.2~dev3-12.23.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ceilometer | 9.0.8~dev7-12.20.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-cinder | 11.2.3~dev23-14.23.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.3~dev7-12.21.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-freezer | 5.0.0.0~xrc2~dev2-10.18.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-glance | 15.0.3~dev3-12.21.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.23.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev2-14.28.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-ironic | 9.1.8~dev8-12.23.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-keystone | 12.0.4~dev5-11.24.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.22.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-manila | 5.1.1~dev2-12.25.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca | 2.2.2~dev1-11.20.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca-ceilometer | 1.5.1_1.5.1_1.5.1~dev3-8.18.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-murano | 4.0.2~dev2-12.18.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-neutron | 11.0.9~dev60-13.26.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-nova | 16.1.9~dev49-11.24.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.6~dev3-12.23.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.5~dev4-11.22.2 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-swift | 2.15.2_2.15.2_2.15.2~dev32-11.16.3 | SUSE-SU-2020:0640-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-trove | 8.0.2~dev2-11.22.2 | SUSE-SU-2020:0640-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | haml | < 5.0.0 | 5.0.0 | GHSA-r53w-g4xm-3gc6 |
Advisories 5
- SUSE-SU-2020:0640-1 Security update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, opens SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-2864-1 ruby-haml - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1986-1 ruby-haml - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:3270-1 Security update for caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, crowbar-ui, etcd, flannel, galera-3, mariadb, mariadb-connector-c, openstack-dashboard-theme-SUSE, openstack-heat-templates, openstack-neutron, openstack-nova, openstack-quickstart, patterns-cloud, python-oslo.messaging, python-oslo.utils, python-pysaml2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2932-1 Security update for rubygem-haml SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2
- https://snyk.io/vuln/SNYK-RUBY-HAML-20362
- [debian-lts-announce] 20191110 [SECURITY] [DLA 1986-1] ruby-haml security update mailing-list
- GLSA-202007-27 vendor-advisory
- [debian-lts-announce] 20211229 [SECURITY] [DLA 2864-1] ruby-haml security update mailing-list