Home / mailings

PDF

[USN-7366-2] Rack vulnerabilities

Posted on 23 July 2025
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-7366-2
July 23, 2025

ruby-rack vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.04

Summary:

Several security issues were fixed in Rack.

Software Description:
- ruby-rack: modular Ruby webserver interface

Details:

USN-7366-1 fixed vulnerabilities in Rack. This update provides the
corresponding updates for Ubuntu 25.04.

Original advisory details:

Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)

Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)

Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
ruby-rack 2.2.7-1.1ubuntu0.25.04.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7366-2
https://ubuntu.com/security/notices/USN-7366-2
CVE-2025-25184, CVE-2025-27111, CVE-2025-27610

Package Information:
https://launchpad.net/ubuntu/+source/ruby-rack/2.2.7-1.1ubuntu0.25.04.2

--===============1626910858289226925==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP