[ubuntu/questing-security] ruby-rack 3.1.16-0.1ubuntu0.1 (Accepted)

[Shishir Subedi]

ruby-rack (3.1.16-0.1ubuntu0.1) questing-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - d/p/CVE-2025-61770-and-CVE-2025-61772.patch: Enforce a size limit for
      the preamble and multipart mime part header 
    - d/p/CVE-2025-61771.patch: Limit amount of retained data when parsing
      multipart requests
    - CVE-2025-61770
    - CVE-2025-61772
    - CVE-2025-61771

  * SECURITY UPDATE: Information discloure using proxy bypass
    - debian/patches/CVE-2025-61780.patch: Fix handling of proxy headers
      (`HTTP_X_SENDFILE_TYPE` and `HTTP_X_ACCEL_MAPPING`) in Rack::Sendfile
    - CVE-2025-61780 

  * SECURITY UPDATE: Denial of service through memory exhaustion
    - debian/patches/CVE-2025-61919.patch: Enforce form parameter limit
      using `query_parser.bytesize_limit` preventing unbounded read of 
      `application/x-www-form-urlencoded` bodies
    - CVE-2025-61919

Date: 2026-01-14 04:02:12.185002+00:00
Changed-By: Shishir Subedi <shishirsub10 at gmail.com>
https://launchpad.net/ubuntu/+source/ruby-rack/3.1.16-0.1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.