USN-6905-1: Rack vulnerabilities

Packages

ruby-rack - modular Ruby webserver interface

Details

It was discovered that Rack incorrectly handled certain regular
expressions. A remote attacker could possibly use this issue to cause
Rack to consume resources, leading to a denial of service.
(CVE-2023-27539)

It was discovered that Rack incorrectly handled Multipart MIME parsing.
A remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-27530)

It was discovered that Rack incorrectly handled certain regular
expressions. A remote attacker could possibly use this issue to cause
Rack to consume resources, leading to a denial of service.
(CVE-2023-27539)

It was discovered that Rack incorrectly handled Multipart MIME parsing.
A remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-27530)

Update instructions

After a standard system update you need to restart any applications using Rack to make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
22.04 jammy	ruby-rack – 2.1.4-5ubuntu1+esm4
20.04 focal	ruby-rack – 2.0.7-2ubuntu0.1+esm4
18.04 bionic	ruby-rack – 1.6.4-4ubuntu0.2+esm5
16.04 xenial	ruby-rack – 1.6.4-3ubuntu0.2+esm5
14.04 trusty	ruby-rack – 1.5.2-3+deb8u3ubuntu1~esm7

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References

Related notices