rack 3.0.6 → 3.0.6.1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of rack might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 2917b0c6ec8772cd25183ae4023a21bf3e9114f20878986597f2f869855a0022
4
- data.tar.gz: a75b0cab6913b118a672c9f7eeae02454f557ce2b7032ffb68f8cdd80bf0f326
3
+ metadata.gz: b43a4c41d97b3e6b9790b04c0713ac20814fa986310ccd17918baaaf3f94b260
4
+ data.tar.gz: a461e437f8cf4591d39d4a84fdceec6ffddb3d11c67fc5a4bdf74926e18d80bc
5
5
  SHA512:
6
- metadata.gz: 5fa7418e0a9f9af9c17fb64fee506eba9e7082d2c2f27df03f4aa3614278ca5b5a9af8ab9b1c630e55f5cccffbd39ba8b13775e5cdc9e5c77fb76922ae6a92d6
7
- data.tar.gz: 18d783dea490e15e3181c2c458e729b88b476d3166db34cd379bc0e93bce066f6f42c84180808f639eddd9a8544d56d20adb9360a440a932c8dc9e016853dd24
6
+ metadata.gz: cb7fcf3c2fa1cd168ff0373246160eec7fa6d94a6b4e5d88438f2239cf79e8b9df708626b32603f63368c1133ca7b3fb00d16a292ca5214a7740c558201c1a0f
7
+ data.tar.gz: 64d3a5fb0603f6f12760bd2ff95a118985eb843b1875d36c9f9f2af37ca413f311e3c566f5861efb159349d9958ef2c78f8d537ba618009d0ca3ac91047d6d53
data/CHANGELOG.md CHANGED
@@ -2,6 +2,10 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
+ ## [3.0.6.1] - 2023-03-13
6
+
7
+ - [CVE-2023-27539] Avoid ReDoS in header parsing
8
+
5
9
  ## [3.0.4.1] - 2023-03-02
6
10
 
7
11
  - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
data/lib/rack/request.rb CHANGED
@@ -666,8 +666,8 @@ module Rack
666
666
  end
667
667
 
668
668
  def parse_http_accept_header(header)
669
- header.to_s.split(/\s*,\s*/).map do |part|
670
- attribute, parameters = part.split(/\s*;\s*/, 2)
669
+ header.to_s.split(",").each(&:strip!).map do |part|
670
+ attribute, parameters = part.split(";", 2).each(&:strip!)
671
671
  quality = 1.0
672
672
  if parameters and /\Aq=([\d.]+)/ =~ parameters
673
673
  quality = $1.to_f
data/lib/rack/version.rb CHANGED
@@ -25,7 +25,7 @@ module Rack
25
25
  VERSION
26
26
  end
27
27
 
28
- RELEASE = "3.0.6"
28
+ RELEASE = "3.0.6.1"
29
29
 
30
30
  # Return the Rack release as a dotted string.
31
31
  def self.release
metadata CHANGED
@@ -1,11 +1,11 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: rack
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.0.6
4
+ version: 3.0.6.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Leah Neukirchen
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
11
  date: 2023-03-13 00:00:00.000000000 Z
@@ -149,7 +149,7 @@ metadata:
149
149
  changelog_uri: https://github.com/rack/rack/blob/main/CHANGELOG.md
150
150
  documentation_uri: https://rubydoc.info/github/rack/rack
151
151
  source_code_uri: https://github.com/rack/rack
152
- post_install_message:
152
+ post_install_message:
153
153
  rdoc_options: []
154
154
  require_paths:
155
155
  - lib
@@ -164,8 +164,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
164
164
  - !ruby/object:Gem::Version
165
165
  version: '0'
166
166
  requirements: []
167
- rubygems_version: 3.4.6
168
- signing_key:
167
+ rubygems_version: 3.0.3.1
168
+ signing_key:
169
169
  specification_version: 4
170
170
  summary: A modular Ruby webserver interface.
171
171
  test_files: []