rack 2.2.6.1 → 2.2.6.2

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of rack might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 3954ca2ddaa60814965ba95a0b8b9c3b38f6dc6348d343f0b950f3b2780748fa
4
- data.tar.gz: a9df63f5080312265894683c21ccaae362c85233112c8d34f1b1919b8c46e5b6
3
+ metadata.gz: 58f641d1882668bf5e150710676e3067def0089d87706cf4b233b11eb5e36cc7
4
+ data.tar.gz: 1ea7a963d41498945e0377b9637ca37df23c9fa41139e83517b37de512be41d7
5
5
  SHA512:
6
- metadata.gz: 03cae09c56cf3e3033bd5e46eecb114931b65ce5d1cfe843a6514c55c19cb518ec7e52444bdb7976932e4647b7fb66be2100062b5ba816b65c17079139382986
7
- data.tar.gz: 1b86e1c18186276473daedac322a237e48fdd51b885ae291800eb1c5500c97f468dfeb7f5a0ac89540f8e2d654e6c414cfa0bdea0fb8cccc84259387386c6f40
6
+ metadata.gz: cafc52d78b4b998df9a973915ccd925de929d9b3b263369c76d3c3efb46d636752dd7260947507c3b4a5a51bab628c007567ef5e5b0759b8b59753ecab93c0f3
7
+ data.tar.gz: c161e73e76fea22a0ef5b4c53c747a63591975c417e426697694d399f204806e6e39ff45e382f7f1938b3c8add90f4492c0c5d754d57685cfc12b486b8ef897f
data/CHANGELOG.md CHANGED
@@ -2,10 +2,13 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
+ ## [2.2.6.2] - 2022-01-17
6
+
7
+ - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
8
+
5
9
  ## [2.2.6.1] - 2022-01-17
6
10
 
7
11
  - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
8
- - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
9
12
  - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
10
13
 
11
14
  ## [2.2.6] - 2022-01-17
data/lib/rack/utils.rb CHANGED
@@ -348,17 +348,18 @@ module Rack
348
348
  return nil unless http_range && http_range =~ /bytes=([^;]+)/
349
349
  ranges = []
350
350
  $1.split(/,\s*/).each do |range_spec|
351
- return nil unless range_spec =~ /(\d*)-(\d*)/
352
- r0, r1 = $1, $2
353
- if r0.empty?
354
- return nil if r1.empty?
351
+ return nil unless range_spec.include?('-')
352
+ range = range_spec.split('-')
353
+ r0, r1 = range[0], range[1]
354
+ if r0.nil? || r0.empty?
355
+ return nil if r1.nil?
355
356
  # suffix-byte-range-spec, represents trailing suffix of file
356
357
  r0 = size - r1.to_i
357
358
  r0 = 0 if r0 < 0
358
359
  r1 = size - 1
359
360
  else
360
361
  r0 = r0.to_i
361
- if r1.empty?
362
+ if r1.nil?
362
363
  r1 = size - 1
363
364
  else
364
365
  r1 = r1.to_i
data/lib/rack/version.rb CHANGED
@@ -20,7 +20,7 @@ module Rack
20
20
  VERSION.join(".")
21
21
  end
22
22
 
23
- RELEASE = "2.2.6.1"
23
+ RELEASE = "2.2.6.2"
24
24
 
25
25
  # Return the Rack release as a dotted string.
26
26
  def self.release
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: rack
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.2.6.1
4
+ version: 2.2.6.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - Leah Neukirchen
@@ -184,7 +184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
184
184
  - !ruby/object:Gem::Version
185
185
  version: '0'
186
186
  requirements: []
187
- rubygems_version: 3.1.6
187
+ rubygems_version: 3.5.0.dev
188
188
  signing_key:
189
189
  specification_version: 4
190
190
  summary: A modular Ruby webserver interface.