USN-7366-1: Rack vulnerabilities

USN-7366-1: Rack vulnerabilities
24 March 2025

Several security issues were fixed in Rack.

Releases
Ubuntu 24.10 Ubuntu 24.04 LTS Ubuntu 22.04 LTS Ubuntu 20.04 LTS Ubuntu 18.04 ESM Ubuntu 16.04 ESM Ubuntu 14.04 ESM

Packages
ruby-rack - modular Ruby webserver interface

Details
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)

Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)

Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• ruby-rack - 2.2.7-1.1ubuntu0.1
  Ubuntu 24.04
• ruby-rack - 2.2.7-1ubuntu0.2
  Ubuntu 22.04
• ruby-rack - 2.1.4-5ubuntu1.1+esm1
  Ubuntu 20.04
• ruby-rack - 2.0.7-2ubuntu0.1+esm6
  Ubuntu 18.04
• ruby-rack - 1.6.4-4ubuntu0.2+esm7
  Ubuntu 16.04
• ruby-rack - 1.6.4-3ubuntu0.2+esm7
  Ubuntu 14.04
• ruby-rack - 1.5.2-3+deb8u3ubuntu1~esm9

In general, a standard system update will make all the necessary changes.