SUSE-SU-2025:4273-1

Details

This update for rubygem-rack fixes the following issues:

Update to version 2.2.20 (bsc#1251936)
CVE-2025-61919: Fixed application/x-www-form-urlencoded, calling rack.input.read(nil)` without enforcing a length or cap (bsc#1251936)
CVE-2025-61780: Fixed improper handling of headers in Rack::Sendfile allows for bypass of proxy-level access restrictions (bsc#1253951)

Affected Packages

ruby2.5-rubygem-rack

SUSE Linux Enterprise High Availability Extension 15 SP3SUSE Linux Enterprise High Availability Extension 15 SP4SUSE Linux Enterprise High Availability Extension 15 SP5SUSE Linux Enterprise High Availability Extension 15 SP6SUSE Linux Enterprise High Availability Extension 15 SP7

Fixed in:

2.2.20-150000.3.34.1

rubygem-rack

SUSE Linux Enterprise High Availability Extension 15 SP3SUSE Linux Enterprise High Availability Extension 15 SP4SUSE Linux Enterprise High Availability Extension 15 SP5SUSE Linux Enterprise High Availability Extension 15 SP6SUSE Linux Enterprise High Availability Extension 15 SP7

Fixed in:

2.2.20-150000.3.34.1

ruby2.5-rubygem-rack-doc

openSUSE Leap 15.6

Fixed in:

2.2.20-150000.3.34.1

References

REPORThttps://bugzilla.suse.com/1251936 REPORThttps://bugzilla.suse.com/1253951 WEBhttps://www.suse.com/security/cve/CVE-2025-61780 WEBhttps://www.suse.com/security/cve/CVE-2025-61919 ADVISORYhttps://www.suse.com/support/update/announcement/2025/suse-su-20254273-1/

SUSE-SU-2025:4273-1

Details

Affected Packages

References

Upstream

Related

Ecosystems(6)

Timeline