Multiple vulnerabilities have been discovered in Rack, the worst of which can lead to sequence injection in logging compontents.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/rack | * | < 2.2.3.1 | >= 2.2.3.1 |
Rack is a modular Ruby web server interface.
Multiple vulnerabilities have been discovered in Rack. Please review the CVE identifiers referenced below for details.
A possible denial of service vulnerability was found in the multipart parsing component of Rack. A sequence injection vulnerability was found which could allow a possible shell escape in the Lint and CommonLogger components of Rack.
There is no known workaround at this time.
All Rack users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rack-2.2.3.1"
Multiple vulnerabilities have been found in Rack, the worst of which allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/rack | * | < 1.4.5 | >= 1.4.5, >= 1.3.10 (revision), >= 1.2.8 (revision), >= 1.1.6 (revision) |
Rack is a modular Ruby web server interface.
Multiple vulnerabilities have been discovered in Rack. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or obtain sensitive information.
There is no known workaround at this time.
All Rack 1.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rack-1.4.5"
All Rack 1.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rack-1.3.10"
All Rack 1.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rack-1.2.8"
All Rack 1.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rack-1.1.6"
A hash collision vulnerability in Rack allows remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/rack | * | < 1.1.3 | >= 1.1.3 |
Rack is a modular Ruby web server interface.
Rack does not properly randomize hash functions to protect against hash collision attacks.
A remote attacker could send a specially crafted form post, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All Rack users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rack-1.1.3"