Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Rack to 3.0.9.1 to Address Warnings #10162

Closed
wants to merge 2 commits into from
Closed

Conversation

charleyf
Copy link
Contributor

@charleyf charleyf commented Feb 26, 2024

🛠 Summary of changes

Currently in main (and all my PRs) running make lint fails with the warnings below.

Running bundle update rack updates rack and fixes this issue. I haven't done any testing beyond that.

--- bundler-audit ---
bundle exec bundler-audit check --update
Updating ruby-advisory-db ...
From https://github.com/rubysec/ruby-advisory-db
 * branch            master     -> FETCH_HEAD
Already up to date.
Updated ruby-advisory-db
ruby-advisory-db:
  advisories:   874 advisories
  last updated: 2024-02-24 17:04:04 -0800
  commit:       5d80bde618c0836393581d7c8eb9ca61600a255f
Name: rack
Version: 3.0.8
CVE: CVE-2024-25126
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941
Title: Denial of Service Vulnerability in Rack Content-Type Parsing
Solution: upgrade to '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'

Name: rack
Version: 3.0.8
CVE: CVE-2024-26141
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944
Title: Possible DoS Vulnerability with Range Header in Rack
Solution: upgrade to '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'

Name: rack
Version: 3.0.8
CVE: CVE-2024-26146
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
Title: Possible Denial of Service Vulnerability in Rack Header Parsing
Solution: upgrade to '~> 2.0.9, >= 2.0.9.4', '~> 2.1.4, >= 2.1.4.4', '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'

Vulnerabilities found!
make: *** [lint] Error 1

@zachmargolis
Copy link
Contributor

I think this is a dupe of #10159

@charleyf charleyf closed this Feb 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants