[ubuntu/oracular-security] ruby-rack 2.2.7-1.1ubuntu0.1 (Accepted)

[Shishir Subedi]

ruby-rack (2.2.7-1.1ubuntu0.1) oracular-security; urgency=medium

  * SECURITY UPDATE: injection vulnerabilities
    - debian/patches/CVE-2025-25184.patch: Escape non-printable
      characters when logging.
    - debian/patches/CVE-2025-27111.patch: Use `#inspect` to prevent log
      injection.
    - CVE-2025-25184
    - CVE-2025-27111
  * SECURITY UPDATE: path traversal vulnerability
    - debian/patches/CVE-2025-27610.patch: Use a fully resolved file
      path when confirming if a file can be served by `Rack::Static`.
    - CVE-2025-27610

Date: 2025-03-24 03:22:11.932499+00:00
Changed-By: Shishir Subedi <shishirsub10 at gmail.com>
https://launchpad.net/ubuntu/+source/ruby-rack/2.2.7-1.1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.