Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rubygem-rack for openSUSE:Factory checked in at 2026-11-02 17:54:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rubygem-rack (Old) and /work/SRC/openSUSE:Factory/.rubygem-rack.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-rack" Mon Nov 2 17:54:05 2026 rev:38 rq:1394494 version:3.2.8 Changes: -------- --- /work/SRC/openSUSE:Factory/rubygem-rack/rubygem-rack.changes 2026-08-17 17:06:42.310367157 +0200 +++ /work/SRC/openSUSE:Factory/.rubygem-rack.new.1255/rubygem-rack.changes 2026-11-02 17:54:08.039483017 +0100 @@ -1,0 +2,16 @@ +Mon Nov 2 14:32:13 UTC 2026 - Hendrik Vogelsang <[email protected]> + +- New upstream release 3.2.8 + - Fix GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan + buffer, allowing denial of service via memory exhaustion. + - Fix GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an + unnormalized path, allowing dot segments to bypass them. + - Fix GHSA-2j8w-xcrc-x985 Rack::Request#host_with_port, #base_url, and #url + returned the raw authority when it was invalid; host_with_port now returns + nil in that case. + - Fix GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary + parameter were accepted when the first value was empty or began with a + quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961. + - For the rest see bundled CHANGELOG.md + +------------------------------------------------------------------- Old: ---- rack-3.2.7.gem New: ---- rack-3.2.8.gem ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rubygem-rack.spec ++++++ --- /var/tmp/diff_new_pack.ywyzlW/_old 2026-11-02 17:54:08.871517845 +0100 +++ /var/tmp/diff_new_pack.ywyzlW/_new 2026-11-02 17:54:08.873517929 +0100 @@ -24,16 +24,16 @@ # Name: rubygem-rack -Version: 3.2.7 +Version: 3.2.8 Release: 0 %define mod_name rack %define mod_full_name %{mod_name}-%{version} # MANUAL BuildRequires: fdupes # /MANUAL -BuildRequires: ruby-macros >= 5 BuildRequires: %{ruby >= 2.4.0} BuildRequires: %{rubygem gem2rpm} +BuildRequires: ruby-macros >= 5 URL: https://github.com/rack/rack Source: https://rubygems.org/gems/%{mod_full_name}.gem Source1: rubygem-rack-rpmlintrc ++++++ rack-3.2.7.gem -> rack-3.2.8.gem ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/CHANGELOG.md new/CHANGELOG.md --- old/CHANGELOG.md 1980-01-02 01:00:00.000000000 +0100 +++ new/CHANGELOG.md 1980-01-02 01:00:00.000000000 +0100 @@ -2,6 +2,19 @@ All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/). +## [3.2.8] - 2026-10-30 + +### Security + +- [GHSA-5v64-555j-wjxm](https://github.com/advisories/GHSA-5v64-555j-wjxm) Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion. +- [GHSA-wvg4-6p58-3gh3](https://github.com/advisories/GHSA-wvg4-6p58-3gh3) `Rack::Static` header rules were matched against an unnormalized path, allowing dot segments to bypass them. +- [GHSA-2j8w-xcrc-x985](https://github.com/advisories/GHSA-2j8w-xcrc-x985) `Rack::Request#host_with_port`, `#base_url`, and `#url` returned the raw authority when it was invalid; `host_with_port` now returns `nil` in that case. +- [GHSA-p8x9-v4hv-2w4g](https://github.com/advisories/GHSA-p8x9-v4hv-2w4g) Multipart requests with more than one `boundary` parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961. + +### Fixed + +- `Rack::Multipart::UploadedFile` now delegates keyword arguments to the wrapped tempfile. Calls such as `uploaded_file.readlines(chomp: true)` raised `TypeError` on Ruby 3.0+. ([#2481](https://github.com/rack/rack/issues/2481), [#2501](https://github.com/rack/rack/pull/2501), [@SeanLF](https://github.com/SeanLF)) + ## [3.2.7] - 2026-08-13 ### Fixed @@ -115,6 +128,15 @@ - `SERVER_NAME` and `HTTP_HOST` are now more strictly validated according to the relevant specifications. ([#2298](https://github.com/rack/rack/pull/2298), [@ioquatix]) - `Rack::Lint` now disallows `PATH_INFO="" SCRIPT_NAME=""`. ([#2298](https://github.com/rack/rack/issues/2307), [@jeremyevans]) +## [3.1.23] - 2026-10-30 + +### Security + +- [GHSA-5v64-555j-wjxm](https://github.com/advisories/GHSA-5v64-555j-wjxm) Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion. +- [GHSA-wvg4-6p58-3gh3](https://github.com/advisories/GHSA-wvg4-6p58-3gh3) `Rack::Static` header rules were matched against an unnormalized path, allowing dot segments to bypass them. +- [GHSA-2j8w-xcrc-x985](https://github.com/advisories/GHSA-2j8w-xcrc-x985) `Rack::Request#host_with_port`, `#base_url`, and `#url` returned the raw authority when it was invalid; `host_with_port` now returns `nil` in that case. +- [GHSA-p8x9-v4hv-2w4g](https://github.com/advisories/GHSA-p8x9-v4hv-2w4g) Multipart requests with more than one `boundary` parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961. + ## [3.1.22] - 2026-08-13 ### Security @@ -539,6 +561,18 @@ - Fix multipart filename generation for filenames that contain spaces. Encode spaces as "%20" instead of "+" which will be decoded properly by the multipart parser. ([#1736](https://github.com/rack/rack/pull/1645), [@muirdm](https://github.com/muirdm)) - `Rack::Request#scheme` returns `ws` or `wss` when one of the `X-Forwarded-Scheme` / `X-Forwarded-Proto` headers is set to `ws` or `wss`, respectively. ([#1730](https://github.com/rack/rack/issues/1730), [@erwanst](https://github.com/erwanst)) +## [2.2.25] - 2026-10-30 + +### Security + +- [GHSA-5v64-555j-wjxm](https://github.com/advisories/GHSA-5v64-555j-wjxm) Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion. +- [GHSA-wvg4-6p58-3gh3](https://github.com/advisories/GHSA-wvg4-6p58-3gh3) `Rack::Static` header rules were matched against an unnormalized path, allowing dot segments to bypass them. +- [GHSA-p8x9-v4hv-2w4g](https://github.com/advisories/GHSA-p8x9-v4hv-2w4g) Multipart requests with more than one `boundary` parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961. + +### Fixed + +- Multipart parser: scan boundary lines with a literal newline search instead of a backtracking regexp, which allocated tens of megabytes per scan for long lines and made the scan buffer fix above ineffective on this series. + ## [2.2.24] - 2026-08-13 ### Security Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/rack/multipart/parser.rb new/lib/rack/multipart/parser.rb --- old/lib/rack/multipart/parser.rb 1980-01-02 01:00:00.000000000 +0100 +++ new/lib/rack/multipart/parser.rb 1980-01-02 01:00:00.000000000 +0100 @@ -127,7 +127,11 @@ unless data[1].empty? raise Error, "whitespace between boundary parameter name and equal sign" end - if data.post_match.match?(/boundary\s*=/i) + # Count across the whole header rather than only after the match: the + # lazy prefix in MULTIPART can skip a first boundary parameter whose + # value is empty or starts with a quote, semicolon, or comma. Also + # count RFC 2231 boundary* parameters, which some parsers prefer. + if content_type.scan(/boundary(?:\*\d*\*?)?\s*=/i).size > 1 raise BoundaryTooLongError, "multiple boundary parameters found in multipart content type" end @@ -494,6 +498,7 @@ # buffering. Note that the actual limit is the higher of 64KB and the buffer size (1MB by default) raise Error, "multipart mime part header too large" if @sbuf.rest.bytesize > MIME_HEADER_BYTESIZE_LIMIT + @sbuf.string = @sbuf.rest return :want_read end end @@ -514,8 +519,8 @@ update_retained_size(body.bytesize) if @body_retained @collector.on_mime_body @mime_index, body @sbuf.pos += delta - @sbuf.string = @sbuf.rest end + @sbuf.string = @sbuf.rest :want_read end end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/rack/multipart/uploaded_file.rb new/lib/rack/multipart/uploaded_file.rb --- old/lib/rack/multipart/uploaded_file.rb 1980-01-02 01:00:00.000000000 +0100 +++ new/lib/rack/multipart/uploaded_file.rb 1980-01-02 01:00:00.000000000 +0100 @@ -77,6 +77,7 @@ def method_missing(method_name, *args, &block) #:nodoc: @tempfile.__send__(method_name, *args, &block) end + ruby2_keywords(:method_missing) if respond_to?(:ruby2_keywords, true) end end end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/rack/request.rb new/lib/rack/request.rb --- old/lib/rack/request.rb 1980-01-02 01:00:00.000000000 +0100 +++ new/lib/rack/request.rb 1980-01-02 01:00:00.000000000 +0100 @@ -325,8 +325,10 @@ end def host_with_port(authority = self.authority) - host, _, port = split_authority(authority) + parts = split_authority(authority) + return nil if parts.empty? + host, _, port = parts if port == DEFAULT_PORTS[self.scheme] host else @@ -592,7 +594,8 @@ end def base_url - "#{scheme}://#{host_with_port}" + hostport = host_with_port || host_with_port(server_authority) + "#{scheme}://#{hostport}" end # Tries to return a remake of the original request URL as a string. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/rack/static.rb new/lib/rack/static.rb --- old/lib/rack/static.rb 1980-01-02 01:00:00.000000000 +0100 +++ new/lib/rack/static.rb 1980-01-02 01:00:00.000000000 +0100 @@ -168,7 +168,7 @@ # Convert HTTP header rules to HTTP headers def applicable_rules(path) - path = ::Rack::Utils.unescape_path(path) + path = ::Rack::Utils.clean_path_info(::Rack::Utils.unescape_path(path)) @header_rules.find_all do |rule, new_headers| case rule diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/rack/version.rb new/lib/rack/version.rb --- old/lib/rack/version.rb 1980-01-02 01:00:00.000000000 +0100 +++ new/lib/rack/version.rb 1980-01-02 01:00:00.000000000 +0100 @@ -6,7 +6,7 @@ # See MIT-LICENSE or https://opensource.org/licenses/MIT. module Rack - VERSION = "3.2.7" + VERSION = "3.2.8" RELEASE = VERSION diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/metadata new/metadata --- old/metadata 1980-01-02 01:00:00.000000000 +0100 +++ new/metadata 1980-01-02 01:00:00.000000000 +0100 @@ -1,7 +1,7 @@ --- !ruby/object:Gem::Specification name: rack version: !ruby/object:Gem::Version - version: 3.2.7 + version: 3.2.8 platform: ruby authors: - Leah Neukirchen
