Sidekiq 5.2.8 locks Rack to 2.0.x (CVE found)

[davidmyersdev]

Ruby: 2.4.6
Sidekiq: 5.2.8
Rack: 2.0.9

Are you using an old version?

No

Have you checked the changelogs to see if your issue has been fixed in a later version?

https://github.com/mperham/sidekiq/blob/master/Changes.md
https://github.com/mperham/sidekiq/blob/master/Pro-Changes.md
https://github.com/mperham/sidekiq/blob/master/Ent-Changes.md

Yes, 5.2.8 is the latest version in the 5.x series.

Problem

A recent CVE has been announced for Rack 2.0.x. Sidekiq will not allow Rack to be upgraded to the recommended versions. Here is the output of bundler audit.

Name: rack
Version: 2.0.9
Advisory: CVE-2020-8161
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
Title: Directory traversal in Rack::Directory app bundled with Rack
Solution: upgrade to ~> 2.1.3, >= 2.2.0

[mperham]

Do you use Rack::Directory? If not, this version doesn’t matter to you. If yes, you can run the 5-x branch.

[davidmyersdev]

@mperham I appreciate the quick response. Our CI builds require bundler-audit to pass, and I'd prefer to not just add an exception for this. Is there a plan to release this under 5.x, or is using the branch the only option?

[mperham]

I'm not in a hurry to release. There's a CVE in a Rack feature that is not enabled by default and the community does not use (at least I've never heard of anyone using it). If someone uses Sidekiq AND Rack::Directory in the same app, please speak up.

[mperham]

For any curious, this will use the branch:

gem 'sidekiq', github: 'mperham/sidekiq', branch: '5-x'

[y-yagi]

Is there any plan to release a new version of the 5.2 series of Sidekiq?
Recently Rack released another security patch and need a new version of Sidekiq to upgrade Rack.
Ref: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8184.yml

[mperham]

Sidekiq 5.2.9 has been released.

[adamzolotarev]

oh, 5.2.9 just relaxed the rack requirements. Doesn't address the disappearing UI issue when you update rack

[mperham]

I don’t know what a disappearing UI is?

…

On Jun 16, 2020, at 09:53, Adam Zolotarev ***@***.***> wrote:  oh, 5.2.9 just relaxed the rack requirements. Doesn't address the disappearing UI issue — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub, or unsubscribe.

[adamzolotarev]

Sorry, looks like it was an issue with New Relic. I just needed to also update New Relic gem based on #4440