rack 2.2.6.1 → 2.2.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3954ca2ddaa60814965ba95a0b8b9c3b38f6dc6348d343f0b950f3b2780748fa
-  data.tar.gz: a9df63f5080312265894683c21ccaae362c85233112c8d34f1b1919b8c46e5b6
+  metadata.gz: 58f641d1882668bf5e150710676e3067def0089d87706cf4b233b11eb5e36cc7
+  data.tar.gz: 1ea7a963d41498945e0377b9637ca37df23c9fa41139e83517b37de512be41d7
 SHA512:
-  metadata.gz: 03cae09c56cf3e3033bd5e46eecb114931b65ce5d1cfe843a6514c55c19cb518ec7e52444bdb7976932e4647b7fb66be2100062b5ba816b65c17079139382986
-  data.tar.gz: 1b86e1c18186276473daedac322a237e48fdd51b885ae291800eb1c5500c97f468dfeb7f5a0ac89540f8e2d654e6c414cfa0bdea0fb8cccc84259387386c6f40
+  metadata.gz: cafc52d78b4b998df9a973915ccd925de929d9b3b263369c76d3c3efb46d636752dd7260947507c3b4a5a51bab628c007567ef5e5b0759b8b59753ecab93c0f3
+  data.tar.gz: c161e73e76fea22a0ef5b4c53c747a63591975c417e426697694d399f204806e6e39ff45e382f7f1938b3c8add90f4492c0c5d754d57685cfc12b486b8ef897f

data/CHANGELOG.md

@@ -2,10 +2,13 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.2.6.2] - 2022-01-17
+
+- [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
+
 ## [2.2.6.1] - 2022-01-17
 
 - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
-- [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
 - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
 
 ## [2.2.6] - 2022-01-17

data/lib/rack/utils.rb

@@ -348,17 +348,18 @@ module Rack
       return nil unless http_range && http_range =~ /bytes=([^;]+)/
       ranges = []
       $1.split(/,\s*/).each do |range_spec|
-        return nil  unless range_spec =~ /(\d*)-(\d*)/
-        r0, r1 = $1, $2
-        if r0.empty?
-          return nil  if r1.empty?
+        return nil unless range_spec.include?('-')
+        range = range_spec.split('-')
+        r0, r1 = range[0], range[1]
+        if r0.nil? || r0.empty?
+          return nil if r1.nil?
           # suffix-byte-range-spec, represents trailing suffix of file
           r0 = size - r1.to_i
           r0 = 0  if r0 < 0
           r1 = size - 1
         else
           r0 = r0.to_i
-          if r1.empty?
+          if r1.nil?
             r1 = size - 1
           else
             r1 = r1.to_i

data/lib/rack/version.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.2.6.1"
+  RELEASE = "2.2.6.2"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.2.6.1
+  version: 2.2.6.2
 platform: ruby
 authors:
 - Leah Neukirchen
@@ -184,7 +184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.5.0.dev
 signing_key:
 specification_version: 4
 summary: A modular Ruby webserver interface.