Debian Package Tracker

general

source: ruby-rack (main)
version: 2.1.1-5
maintainer: Debian Ruby Extras Maintainers (archive) (DMD)
uploaders: Youhei SASAKI [DMD] [DM] – Utkarsh Gupta [DMD] – Paul van Tilburg [DMD] – Lucas Nussbaum [DMD] – Chris Lamb [DMD]
arch: all
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.5.2-3+deb8u1
o-o-sec: 1.5.2-3+deb8u3
oldstable: 1.6.4-4+deb9u1
old-sec: 1.6.4-4+deb9u2
old-bpo: 1.6.4-5~bpo9+1
stable: 2.0.6-3
stable-bpo: 2.1.1-4~bpo10+1
testing: 2.1.1-5
unstable: 2.1.1-5

versioned links

1.5.2-3+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.5.2-3+deb8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.6.4-4+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.6.4-4+deb9u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.6.4-5~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.0.6-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.1.1-4~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.1.1-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ruby-rack

action needed

A new upstream version is available: 2.2.3 high

A new upstream version 2.2.3 is available, you should consider packaging it.

Created: 2020-06-29 Last update: 2020-10-25 02:35

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2020-8184: A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Please fix it.

Created: 2020-06-22 Last update: 2020-08-25 23:54

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2020-8184: A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Please fix it.

Created: 2020-06-22 Last update: 2020-08-25 23:54

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

ruby-rack could have its dependency on ruby annotated with :any

Created: 2020-04-11 Last update: 2020-10-25 04:09

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 430d5291c0ef6776990019bb8883abfb4ec1de59
Author: Cédric Boutillier <boutil@debian.org>
Date:   Thu Sep 3 20:37:22 2020 +0000

    [ci skip] Add .gitattributes to keep unwanted files out of the source package

commit c9a617b2ee4d40df2e5e16b9cababec88bb4e922
Author: Cédric Boutillier <boutil@debian.org>
Date:   Tue Sep 1 14:05:18 2020 +0000

    [ci skip] Update team name

Created: 2020-09-01 Last update: 2020-10-18 19:10

1 ignored security issue in stretch low

There is 1 open security issue in stretch.

1 issue skipped by the security teams:

CVE-2019-16782: There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Please fix it.

Created: 2019-12-19 Last update: 2020-08-25 23:54

3 ignored security issues in buster low

There are 3 open security issues in buster.

3 issues skipped by the security teams:

CVE-2019-16782: There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
CVE-2020-8161: A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
CVE-2020-8184: A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Please fix them.

Created: 2019-12-19 Last update: 2020-08-25 23:54

news

[rss feed]

[2020-07-10] Accepted ruby-rack 1.6.4-4+deb9u2 (source all) into oldstable (Utkarsh Gupta)
[2020-05-24] ruby-rack 2.1.1-5 MIGRATED to testing (Debian testing watch)
[2020-05-22] Accepted ruby-rack 1.5.2-3+deb8u3 (source all) into oldoldstable (Utkarsh Gupta)
[2020-05-22] Accepted ruby-rack 2.1.1-5 (source) into unstable (Utkarsh Gupta)
[2020-04-23] Accepted ruby-rack 2.1.1-4~bpo10+1 (source all) into buster-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-04-23] Accepted ruby-rack 2.1.1-3~bpo10+1 (source all) into buster-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-04-17] ruby-rack 2.1.1-4 MIGRATED to testing (Debian testing watch)
[2020-04-10] Accepted ruby-rack 2.1.1-4 (source) into unstable (Utkarsh Gupta)
[2020-04-09] Accepted ruby-rack 2.1.1-3 (source) into unstable (Utkarsh Gupta)
[2020-04-09] Accepted ruby-rack 2.1.1-2 (source) into unstable (Utkarsh Gupta)
[2020-03-10] ruby-rack 2.0.8-1 MIGRATED to testing (Debian testing watch)
[2020-03-07] Accepted ruby-rack 2.0.8-1 (source) into unstable (Utkarsh Gupta)
[2020-01-13] Accepted ruby-rack 2.1.1-1 (source) into experimental (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2019-10-14] Accepted ruby-rack 2.0.7-2~bpo10+1 (source all) into buster-backports, buster-backports (Samyak Jain) (signed by: Sruthi Chandran)
[2019-09-05] ruby-rack 2.0.7-2 MIGRATED to testing (Debian testing watch)
[2019-09-02] Accepted ruby-rack 2.0.7-2 (source) into unstable (Utkarsh Gupta)
[2019-05-15] Accepted ruby-rack 2.0.7-1 (source) into experimental (Utkarsh Gupta) (signed by: Praveen Arimbrathodiyil)
[2019-02-06] ruby-rack 2.0.6-3 MIGRATED to testing (Debian testing watch)
[2019-01-11] Accepted ruby-rack 2.0.6-3 (source) into unstable (Antonio Terceiro)
[2019-01-03] Accepted ruby-rack 1.6.4-4+deb9u1 (source all) into proposed-updates->stable-new, proposed-updates (Chris Lamb)
[2019-01-03] Accepted ruby-rack 2.0.6-2 (source) into unstable (Sruthi Chandran) (signed by: Praveen Arimbrathodiyil)
[2018-12-25] Accepted ruby-rack 2.0.6-1 (source) into experimental (Sruthi Chandran) (signed by: Praveen Arimbrathodiyil)
[2018-11-23] ruby-rack 1.6.4-6 MIGRATED to testing (Debian testing watch)
[2018-11-21] Accepted ruby-rack 2.0.5-2 (source all) into experimental (Chris Lamb)
[2018-11-21] Accepted ruby-rack 1.5.2-3+deb8u2 (source all) into oldstable (Chris Lamb)
[2018-11-21] Accepted ruby-rack 1.6.4-6 (source all) into unstable (Chris Lamb)
[2018-09-29] Accepted ruby-rack 1.6.4-5~bpo9+1 (source all) into stretch-backports, stretch-backports (Lucas Kanashiro)
[2018-09-15] ruby-rack 1.6.4-5 MIGRATED to testing (Debian testing watch)
[2018-09-13] Accepted ruby-rack 1.6.4-5 (source all) into unstable (Lucas Kanashiro)
[2018-08-01] Accepted ruby-rack 2.0.5-1 (source) into experimental (Sruthi Chandran) (signed by: Praveen Arimbrathodiyil)

bugs [bug history graph]

all: 3
RC: 0
I&N: 3
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.1.1-5