[SECURITY] [DLA 3392-1] ruby-rack security update

2023-04-1714:31:02

lists.debian.org

redos issue

debian lts advisory

cve-2023-27539

ruby-rack

cve-2023-27530

debian 10 buster

security update

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

Debian LTS Advisory DLA-3392-1 [email protected]
https://www.debian.org/lts/security/ Scarlett Moore
April 17, 2023 https://wiki.debian.org/LTS

Package : ruby-rack
Version : 2.0.6-3+deb10u3
CVE ID : CVE-2023-27530 CVE-2023-27539
Debian Bug :

Two ruby-rack issues have been addressed:

CVE-2023-27530

Description: Limit all multipart parts, not just files.

CVE-2023-27539

Description: Split headers on commas, then strip the strings in
order to avoid ReDoS issues.

For Debian 10 buster, these problems have been fixed in version
2.0.6-3+deb10u3.

We recommend that you upgrade your ruby-rack packages.

For the detailed security status of ruby-rack please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-rack

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10allruby-rack< 2.0.6-3+deb10u3ruby-rack_2.0.6-3+deb10u3_all.deb
Debian11allruby-rack< 2.1.4-3+deb11u1ruby-rack_2.1.4-3+deb11u1_all.deb