Accepted ruby-rack 2.0.6-3+deb10u2 (source) into oldstable
- To: dispatch@tracker.debian.org, debian-lts-changes@lists.debian.org
- Subject: Accepted ruby-rack 2.0.6-3+deb10u2 (source) into oldstable
- From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
- Date: Mon, 30 Jan 2023 01:10:22 +0000
- Debian: DAK
- Debian-architecture: source
- Debian-archive-action: accept
- Debian-changes: ruby-rack_2.0.6-3+deb10u2_source.changes
- Debian-source: ruby-rack
- Debian-suite: oldstable
- Debian-version: 2.0.6-3+deb10u2
- Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.seger; h=Date:Message-Id: Content-Transfer-Encoding:Content-Type:Subject:MIME-Version:To:Reply-To:From: Cc:Content-ID:Content-Description:In-Reply-To:References; bh=skefnrw7i2VcePTsnjKkRVQQi+HuU8V0oVS//G/kR3c=; b=F/oAhltzZj7n5dDBUo+N3ZZl5I 2ygqYh+MIJ1EXzXE3TlADCyOlQh2VLq86etkd8gs6WRqsuWh1wSINvcD4nilZ2tFppGHMVMGg0Mta HMWiCHQiLJTUE1E7pGE5xNYgnXNU3609tmiFqe/8/63f+xHFKY79VArcNUVFDCf/jG/QqZv4buaRz t5ibpvj79oCGpCKreiprHKg/gt3RxY67aHqZSjkG5jLuLt+ldhNpOP+r99mXKUkdXCJx3s9EzaM0m GY6B/Jan/o4CoH4A/kJOs3Mowj1DWnrJexLYNMJ0t9A0fGrIz0M0OdtTEBq4UgNFY5f/ukEFIZyTM SFvHzfkw==;
- Mail-followup-to: debian-lts@lists.debian.org
- Message-id: <E1pMIgg-0030On-5W@seger.debian.org>
- Reply-to: debian-lts@lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 30 Jan 2023 05:46:25 +0530
Source: ruby-rack
Architecture: source
Version: 2.0.6-3+deb10u2
Distribution: buster-security
Urgency: high
Maintainer: Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
Changed-By: Utkarsh Gupta <utkarsh@debian.org>
Closes: 963477 1029832
Changes:
ruby-rack (2.0.6-3+deb10u2) buster-security; urgency=high
.
* Non-maintainer upload by the LTS team. (Closes: #1029832)
* Add patch to use Dir.entries instead of Dir[glob] to prevent
user-specified glob metacharactersfix. (Fixes: CVE-2020-8161)
* When parsing cookies, only decode the values. Patch utils to fix
cookie parsing. (Fixes: CVE-2020-8184) (Closes: #963477)
* Add patch to fix ReDoS in Rack::Utils.get_byte_ranges.
(Fixes: CVE-2022-44570)
* Add patch to fix ReDoS vulnerability in multipart parser.
(Fixes: CVE-2022-44571)
* Add patch to forbid control characters in attributes.
(Fixes: CVE-2022-44572)
Checksums-Sha1:
c4eda6e98bc1a0fa8a5e1db1a93f28f09154437a 2279 ruby-rack_2.0.6-3+deb10u2.dsc
bef6a13d81a8000634ea30dae30cb906d7a71f91 253423 ruby-rack_2.0.6.orig.tar.gz
c2d4a17c9b95e401d8ed97819ffdf4468e927997 10624 ruby-rack_2.0.6-3+deb10u2.debian.tar.xz
d2d316c79d381f4e3f1c745ceb2a01b38656d126 14208 ruby-rack_2.0.6-3+deb10u2_source.buildinfo
Checksums-Sha256:
739f22771d16203a825c08c1435c811aa6fba6f9338412d85aef5757e73338c5 2279 ruby-rack_2.0.6-3+deb10u2.dsc
62c3a92e98a61fcb5423ff7f46726a17e48930c4ccc817daaaa93e9038922c5a 253423 ruby-rack_2.0.6.orig.tar.gz
2561d11094805271c144ab13df18335d7eb579cb06161dd5da248fc6e8be30e1 10624 ruby-rack_2.0.6-3+deb10u2.debian.tar.xz
4a5607603be82284943e949bcc6b8db591de077ebc6f2d27b4ba204d8be0e824 14208 ruby-rack_2.0.6-3+deb10u2_source.buildinfo
Files:
9cfc601b818d35d8cf7a1aaca80bea4d 2279 ruby optional ruby-rack_2.0.6-3+deb10u2.dsc
a089f87b15056562ce44645965ddbc97 253423 ruby optional ruby-rack_2.0.6.orig.tar.gz
34a4bf7a89dc3459db879a3d1e72129a 10624 ruby optional ruby-rack_2.0.6-3+deb10u2.debian.tar.xz
cc1a9a8d2047aca428ecbc38b1ce2cf4 14208 ruby optional ruby-rack_2.0.6-3+deb10u2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJHBAEBCAAxFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmPXFIkTHHV0a2Fyc2hA
ZGViaWFuLm9yZwAKCRCCPpZ2BsNLlletD/42Fef/Ojocq1RXNEM9kOWitluZHWNL
hJttdkAz1Iq9YzguOyVlUmYDxQ4rSvKPS3xyXtM6UKyMMDuZT7SYWPcl9G7uYLrI
isyT/uQrOtvwm0cemmFSdq5Wahqgs99Kfclit8nCPCASY2MQuKaIP5pgyb38VGCj
rlbUj7igzsRP918U8h4c+NSuwvOVjbNe27N6EXHSRt8wknpvbx1o6lg831imuVwZ
i+7FIi1jPA859q/AVPdgZw8Me5DdhmFomaDL+Txbha5kb55xpPQwvFwgVtwhnr2Y
tTmwXl5sD/4GvHyByvvv7XY3pJdpLHTw2uGg34yAYG8lgxrt3aZ4BLqZzXDpPumj
FKcMNoOW9Sj/7CT2K4u9QikSaTOrKuwLw58njHX14jKmx3ETu6G0BVV18wDP+b72
TROdt7+jObeePbwaF3SRPMARcEie4X0XXw6ujUKFSEStTxazLnGcQ0ttsfyGJwC0
vRXd/hLBUlycoLxt71ngT67nSApErOW8aAqNNSwqDTkB1zmwl06HPS7cZKgxfEHw
zFNSdXR/uNf0DmITRhexR7phollnLVtERkJYAoEH642rwi4d2etUOBx5YBSC+uO+
5XRW7jQUrULJ251uaOAj2IB0f5650Lb0E5JbTxShUVgCkuId7aCUrx8tDkYROQob
/I+pds5CXWENBg==
=i4aU
-----END PGP SIGNATURE-----