rack 3.0.6 → 3.0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2917b0c6ec8772cd25183ae4023a21bf3e9114f20878986597f2f869855a0022
-  data.tar.gz: a75b0cab6913b118a672c9f7eeae02454f557ce2b7032ffb68f8cdd80bf0f326
+  metadata.gz: b43a4c41d97b3e6b9790b04c0713ac20814fa986310ccd17918baaaf3f94b260
+  data.tar.gz: a461e437f8cf4591d39d4a84fdceec6ffddb3d11c67fc5a4bdf74926e18d80bc
 SHA512:
-  metadata.gz: 5fa7418e0a9f9af9c17fb64fee506eba9e7082d2c2f27df03f4aa3614278ca5b5a9af8ab9b1c630e55f5cccffbd39ba8b13775e5cdc9e5c77fb76922ae6a92d6
-  data.tar.gz: 18d783dea490e15e3181c2c458e729b88b476d3166db34cd379bc0e93bce066f6f42c84180808f639eddd9a8544d56d20adb9360a440a932c8dc9e016853dd24
+  metadata.gz: cb7fcf3c2fa1cd168ff0373246160eec7fa6d94a6b4e5d88438f2239cf79e8b9df708626b32603f63368c1133ca7b3fb00d16a292ca5214a7740c558201c1a0f
+  data.tar.gz: 64d3a5fb0603f6f12760bd2ff95a118985eb843b1875d36c9f9f2af37ca413f311e3c566f5861efb159349d9958ef2c78f8d537ba618009d0ca3ac91047d6d53

data/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [3.0.6.1] - 2023-03-13
+
+- [CVE-2023-27539] Avoid ReDoS in header parsing
+
 ## [3.0.4.1] - 2023-03-02
 
 - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts

data/lib/rack/request.rb

@@ -666,8 +666,8 @@ module Rack
       end
 
       def parse_http_accept_header(header)
-        header.to_s.split(/\s*,\s*/).map do |part|
-          attribute, parameters = part.split(/\s*;\s*/, 2)
+        header.to_s.split(",").each(&:strip!).map do |part|
+          attribute, parameters = part.split(";", 2).each(&:strip!)
           quality = 1.0
           if parameters and /\Aq=([\d.]+)/ =~ parameters
             quality = $1.to_f

data/lib/rack/version.rb

@@ -25,7 +25,7 @@ module Rack
     VERSION
   end
 
-  RELEASE = "3.0.6"
+  RELEASE = "3.0.6.1"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,11 +1,11 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 3.0.6
+  version: 3.0.6.1
 platform: ruby
 authors:
 - Leah Neukirchen
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
 date: 2023-03-13 00:00:00.000000000 Z
@@ -149,7 +149,7 @@ metadata:
   changelog_uri: https://github.com/rack/rack/blob/main/CHANGELOG.md
   documentation_uri: https://rubydoc.info/github/rack/rack
   source_code_uri: https://github.com/rack/rack
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -164,8 +164,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.6
-signing_key:
+rubygems_version: 3.0.3.1
+signing_key: 
 specification_version: 4
 summary: A modular Ruby webserver interface.
 test_files: []