[IT-SecNots] [SECURITY] [DSA 3322-1] ruby-rack security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3322-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
July 31, 2015                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : ruby-rack
CVE ID         : CVE-2015-3225
Debian Bug     : 789311

Tomek Rabczak from the NCC Group discovered a flaw in the
normalize_params() method in Rack, a modular Ruby webserver interface.
A remote attacker can use this flaw via specially crafted requests to
cause a `SystemStackError` and potentially cause a denial of service
condition for the service.

For the oldstable distribution (wheezy), this problem has been fixed
in version 1.4.1-2.1+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 1.5.2-3+deb8u1.

For the unstable distribution (sid), this problem has been fixed in
version 1.5.2-4.

We recommend that you upgrade your ruby-rack packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVu9FfAAoJEAVMuPMTQ89EtasP/isRvloSrZg5M+yn5jwzXm9P
s+EssK1s26BQIzEBoxqEsUBVdjVH7Jrf0BHfAiTZoqjOB8SGqun/CV8B0tQGe911
MGumBe1I6458y1a1EbydHfnFoWouUveMd8AyO9HBXpvUXyRLowUQ0FvwxVKh10z1
+63+ckR1BvuZj7HlipTSeyFTd59QgGX+Z84kIdJuy4da+0OWrG2EWwXS6cAFCyVA
mBogkE/4/XydrYt1ia3MuGdsrfiAKCEVq+WOQxpURtqLREY0UFNs+8OUuigu5RS+
gxLFE1kZpGa0f9fn+1mf19h1VBGbaRMqR1/kFrBHWWXQbCtmdHU62IbluLrD7wNg
tw16+9WZ4N+izNOWwT+F+ZvvEI2bg/pC6NmLzYwTqnK4WePrMsCQYncFKqxNq4MQ
W4C2gr/aKYNkExMx9uVJm51T8ObFmtHdCeli48b8fnB987krT4lXDstWEJBMr1wg
oE3UbxgeHyYmO3g+V+TceNLg47mKhgU/+8a28zHNCHBWVhKi+CyKIqWJ+GC6f1/F
6etfMsnD8jN6GOS7Xh5TlHpZ6BoGuLQNsvpeQceST4DtFn5Ap8XxXi25aIvpIqot
Q/XBdetalH92qTMlRixNsK23w/MCDu9wC3nwMqqsoX4tmEUjuMTbRCpW4j7AZgZ1
YqOyA+8ehwEsiv2VR6F0
=jxhT
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST AT lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster AT lists.debian.org
Archive: E1ZLGKH-00070P-4m AT master.debian.org">https://lists.debian.org/E1ZLGKH-00070P-4m AT master.debian.org