New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency rack to v2.2.8.1 #215

Open

mend-for-github-com wants to merge 1 commit into master from whitesource-remediate/rack-2.x-lockfile

mend-for-github-com bot commented Mar 26, 2023 •

edited

This PR contains the following updates:

Package	Update	Change
rack (changelog)	patch	`2.2.3` -> `2.2.8.1`

By merging this PR, the below issues will be automatically resolved and closed:

Severity	CVSS Score	CVE	GitHub Issue
Critical	10.0	CVE-2022-30123	#149
High	7.5	CVE-2022-30122	#150
High	7.5	CVE-2022-44570	#204
High	7.5	CVE-2022-44571	#203
High	7.5	CVE-2022-44572	#205
High	7.5	CVE-2023-27530	#209
High	7.5	CVE-2023-27539	#211
Medium	5.8	CVE-2024-26141	#252
Medium	5.3	CVE-2024-25126	#250
Medium	5.3	CVE-2024-26146	#251

Release Notes

rack/rack (rack)

`v2.2.8.1`

What's Changed

Fixed ReDoS in Accept header parsing [CVE-2024-26146]
Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v2.2.8...v2.2.8.1

`v2.2.8`

What's Changed

Limit file extension length of multipart tempfiles (2.2 backport) by @dentarg in https://github.com/rack/rack/pull/2075
CHANGELOG: Add missing 2.2.7 by @tisba in https://github.com/rack/rack/pull/2081
Update cookie.rb by @dchandekstark in https://github.com/rack/rack/pull/2092
Prefer ubuntu-latest for testing. by @ioquatix in https://github.com/rack/rack/pull/2095
Fix inefficient assert pattern in Rack::Lint [2-2-stable] by @skipkayhil in https://github.com/rack/rack/pull/2101
Regenerate SPEC [2-2-stable] by @skipkayhil in https://github.com/rack/rack/pull/2102

New Contributors

@tisba made their first contribution in https://github.com/rack/rack/pull/2081
@dchandekstark made their first contribution in https://github.com/rack/rack/pull/2092

Full Changelog: rack/rack@v2.2.7...v2.2.8

`v2.2.7`

What's Changed

Correct the year number in the changelog by @kimulab in https://github.com/rack/rack/pull/2015
Support underscore in host names for Rack 2.2 (Fixes #2070) by @jeremyevans in https://github.com/rack/rack/pull/2071

New Contributors

@kimulab made their first contribution in https://github.com/rack/rack/pull/2015

Full Changelog: rack/rack@v2.2.6.4...v2.2.7

`v2.2.6.4`

`v2.2.6.3`

`v2.2.6.2`

`v2.2.6.1`

`v2.2.6`

`v2.2.5`

`v2.2.4`

Better support for lower case headers in Rack::ETag middleware. (#1919, @ioquatix)
Use custom exception on params too deep error. (#1838, @simi)

`v2.2.3.1`

Security

[CVE-2022-30123] Fix shell escaping issue in Common Logger
[CVE-2022-30122] Restrict parsing of broken MIME attachments

If you want to rebase/retry this PR, check this box

mend-for-github-com bot added the security fix label


          Update dependency rack to v2.2.8.1

f35098e

mend-for-github-com bot force-pushed the whitesource-remediate/rack-2.x-lockfile branch from fde9a5c to f35098e Compare

March 17, 2024 13:58

mend-for-github-com bot changed the title ~~Update dependency rack to v2.2.6.4~~ Update dependency rack to v2.2.8.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment