[SECURITY] [DLA 2275-1] ruby-rack security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -----------------------------------------------------------------------
Debian LTS Advisory DLA-2275-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Utkarsh Gupta
July 10, 2020 https://wiki.debian.org/LTS
- -----------------------------------------------------------------------
Package : ruby-rack
Version : 1.6.4-4+deb9u2
CVE ID : CVE-2020-8161 CVE-2020-8184
Debian Bug : 963477
The following CVEs were reported against src:ruby-rack.
CVE-2020-8161
A directory traversal vulnerability exists in rack < 2.2.0 that
allows an attacker perform directory traversal vulnerability in
the Rack::Directory app that is bundled with Rack which could
result in information disclosure.
CVE-2020-8184
A reliance on cookies without validation/integrity check security
vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it
is possible for an attacker to forge a secure or host-only cookie
prefix.
For Debian 9 stretch, these problems have been fixed in version
1.6.4-4+deb9u2.
We recommend that you upgrade your ruby-rack packages.
For the detailed security status of ruby-rack please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-rack
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl8Ix/wACgkQgj6WdgbD
S5aT2xAA1MdxuJAX1aEg4egnpTib4yLVbU6rvGhy3SSpHkkhDfIyKiz+bZ/lWv+R
uKNE9scEoH1kl7ZatH/jgtDo4jAWG2fRr3/YeumqS/Mfd3X+W8wk7hv4V+nnCbUp
EjOV6sUjUeC5onJB7+hZBwsSwl4Vju+QCJHecpL2fYBG6oRuw5CLjpdDviqf343R
41H8tKi+t2U/FCSDMjig6vKm/3C0aFwcFERDc3rw3ggpHFG1Ix6UrS7/We3wqiz1
obPPh4s52t6HAiX2eQ+pEI0abgBUTYk/qHz9EHsUfvLlO+x0D+XSzGF2qJVN1vN5
XwnxiPA2+1lz37vddKFqYurL30so/VA8E3JJpcUE1oeJOK1OcgQcWNSKJ2ztchxW
JAoOjG+oGtIYxQMHfBjmXfFmyOBHFCNMlD9WG4Sbg3j8WBL+5QD8PW6BD0iqZ1Ju
zvGya0EEOYbf2yR6oWzHMExR2pMnXrJ/0kJiQrJbIxQTi6W48opf6tfP/o/O0b52
6InnuvLihnYje80xQcSZIeYu3PE0rN6W8fyXcL7z47stD5Xbl7ffsP1jwWUTOOeE
KqI3SUMuj1qsQA7lkcfMoywXKP+FGd3Wk51bNcIlofiG/kCTh6LUCCHgRTKkSzDt
wZDfKpvKmML4EzfNI/YYdEXCqqO978o6ZvlblO9x4TRHnS9iT+M=
=KgBu
-----END PGP SIGNATURE-----
Reply to: