Closed torresga closed 4 months ago
This PR fixes the following 'High' and 'Critical' security vulnerabilities found in the current version of rack (2.2.3):
rack
Name: rack Version: 2.2.3 CVE: CVE-2022-30123 GHSA: GHSA-wq4h-7r42-5hrr Criticality: Critical URL: https://groups.google.com/g/ruby-security-ann/c/LWB10kWzag8 Title: Possible shell escape sequence injection vulnerability in Rack Solution: upgrade to '~> 2.0.9, >= 2.0.9.1', '~> 2.1.4, >= 2.1.4.1', '>= 2.2.3.1' Name: rack Version: 2.2.3 CVE: CVE-2022-30122 GHSA: GHSA-hxqx-xwvh-44m2 Criticality: High URL: https://groups.google.com/g/ruby-security-ann/c/L2Axto442qk Title: Denial of Service Vulnerability in Rack Multipart Parsing Solution: upgrade to '~> 2.0.9, >= 2.0.9.1', '~> 2.1.4, >= 2.1.4.1', '>= 2.2.3.1' Name: rack Version: 2.2.3 CVE: CVE-2022-44570 GHSA: GHSA-65f5-mfpf-vfhj Criticality: High URL: https://github.com/rack/rack/releases/tag/v3.0.4.1 Title: Denial of service via header parsing in Rack Solution: upgrade to '~> 2.0.9, >= 2.0.9.2', '~> 2.1.4, >= 2.1.4.2', '~> 2.2.6, >= 2.2.6.2', '>= 3.0.4.1' Name: rack Version: 2.2.3 CVE: CVE-2023-27530 GHSA: GHSA-3h57-hmj3-gj3p Criticality: High URL: https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388 Title: Possible DoS Vulnerability in Multipart MIME parsing Solution: upgrade to '~> 2.0.9, >= 2.0.9.3', '~> 2.1.4, >= 2.1.4.3', '~> 2.2.6, >= 2.2.6.3', '>= 3.0.4.2'
QA Notes:
bin/parallel_rspec
bundler-audit
gem install bundler-audit
This has passed tests, is it ready to merge?
@sethherr Yes, this is ready to merge!
This PR fixes the following 'High' and 'Critical' security vulnerabilities found in the current version of
rack
(2.2.3):QA Notes:
bin/parallel_rspec
to ensure there are no spec failures related to the update.bundler-audit
if it's not already installed:gem install bundler-audit
.bundler-audit
and ensure thatrack
is not included in the list of vulnerabilties.