Accepted rails 2:7.2.2.2+dfsg-2~deb13u2 (source) into proposed-updates

Debian FTP Masters Sun, 11 Oct 2026 04:52:43 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 04 Oct 2026 16:13:12 -0500
Source: rails
Architecture: source
Version: 2:7.2.2.2+dfsg-2~deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Debian Ruby Team 
<[email protected]>
Changed-By: Simon Quigley <[email protected]>
Closes: 1132035 1143080
Changes:
 rails (2:7.2.2.2+dfsg-2~deb13u2) trixie-security; urgency=high
 .
   * CVE-2026-66066: disable libvips unfuzzed loaders and savers when
     Active Storage loads ruby-vips. BMP, ICO, and PSD variants then
     raise Vips::Error (Closes: #1143080).
   * CVE-2026-33168: skip blank HTML attribute names in tag helpers.
     A blank attribute name bypasses escaping and produces malformed
     HTML. A crafted value can be read as a separate attribute, possibly
     leading to XSS (Closes: #1132035).
   * CVE-2026-33169: delimit numbers without the backtracking expression.
     The lookahead regular expression and gsub! can take quadratic time
     on a long digit string (Closes: #1132035).
   * CVE-2026-33170: keep an unsafe SafeBuffer unsafe after %.
     SafeBuffer#% does not copy the html_safe flag. Formatting a buffer
     mutated in place, with untrusted arguments, reports html_safe? and
     bypasses ERB escaping (Closes: #1132035).
   * CVE-2026-33173: drop analyzed, identified, and composed from
     direct uploads.
     Direct upload metadata can set those flags, skip MIME detection,
     and claim a safe content_type for other content (Closes: #1132035).
   * CVE-2026-33174: reject Active Storage byte ranges larger than 100MB.
     The proxy loads the whole requested byte range into memory. A large
     or unbounded Range header can exhaust memory. Ranges whose total
     size reaches 100MB are now rejected (Closes: #1132035).
   * CVE-2026-33176: do not expand scientific notation in number helpers.
     Strings such as 1e10000 are expanded by BigDecimal into a huge
     representation, which can exhaust memory and CPU (Closes: #1132035).
   * CVE-2026-33195: reject disk keys that leave the Active Storage root.
     DiskService#path_for does not keep the resolved path inside the
     storage root. A key containing ../ can read, write, or delete files
     outside it (Closes: #1132035).
   * CVE-2026-33202: escape glob metacharacters in
     DiskService#delete_prefixed.
     The prefix is passed to Dir.glob without escaping. A key containing
     glob metacharacters can delete a different file (Closes: #1132035).
   * CVE-2026-33658: allow only one byte range on Active Storage proxies.
     The proxy does not limit how many ranges a Range header may contain.
     Thousands of small ranges use much more CPU than one request for the
     same file (Closes: #1132035).
Checksums-Sha1:
 647af4aab1c6a55b60b9cb720554baa4e9c944c5 4704 rails_7.2.2.2+dfsg-2~deb13u2.dsc
 e1ce8744c85847eaf81dffb1c2436271dc3c43ec 115212 
rails_7.2.2.2+dfsg-2~deb13u2.debian.tar.xz
 01c194615a2b4599d171f1c019a63dc39f1148db 21120 
rails_7.2.2.2+dfsg-2~deb13u2_source.buildinfo
Checksums-Sha256:
 2a17eb5a9c943ebf358525e1d170a1b93f685f7e657f5ad539871b513789b6c3 4704 
rails_7.2.2.2+dfsg-2~deb13u2.dsc
 33bf3623384401509bfc0a48ea864bdea8eae245a053cdf2789b37dd67688ab6 115212 
rails_7.2.2.2+dfsg-2~deb13u2.debian.tar.xz
 b7d493a01e645b18147a6e8194b12d85e7b67e731a22b170870e04389344e1d2 21120 
rails_7.2.2.2+dfsg-2~deb13u2_source.buildinfo
Files:
 26717cee511e673179ec708f9bf360bc 4704 ruby optional 
rails_7.2.2.2+dfsg-2~deb13u2.dsc
 0507b6a8774496ada3dd0c1e29e0fc88 115212 ruby optional 
rails_7.2.2.2+dfsg-2~deb13u2.debian.tar.xz
 70c96df2535b35d71d39989eaf15bb85 21120 ruby optional 
rails_7.2.2.2+dfsg-2~deb13u2_source.buildinfo
pgpI89OnF5VCn.pgp
Description: PGP signature
Accepted rails 2:7.2.2.2+dfsg-2~deb13u2 (source) into proposed-updates

Reply via email to
