Your message dated Wed, 16 Jul 2025 12:16:31 +0000
with message-id <[email protected]>
and subject line unblock ruby-rack-session
has caused the Debian Bug report #1109345,
regarding unblock: ruby-rack-session/2.1.1-0.1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1109345: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109345
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:ruby-rack-session
User: [email protected]
Usertags: unblock
Please unblock package ruby-rack-session
[ Reason ]
Grave bug #1104928.
[ Impact ]
Security issue enables session recovery.
[ Tests ]
The debdiff introduces a new test to check for the vulnerability.
[ Risks ]
None.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
[ Other info ]
I have handled this as NMU.
unblock ruby-rack-session/2.1.1-0.1
diff -Nru ruby-rack-session-2.1.0/debian/changelog
ruby-rack-session-2.1.1/debian/changelog
--- ruby-rack-session-2.1.0/debian/changelog 2025-03-08 16:10:24.000000000
+0100
+++ ruby-rack-session-2.1.1/debian/changelog 2025-07-15 13:10:44.000000000
+0200
@@ -1,3 +1,10 @@
+ruby-rack-session (2.1.1-0.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * New upstream version 2.1.1. (Closes: #1104928, CVE-2025-46336)
+
+ -- Bastian Germann <[email protected]> Tue, 15 Jul 2025 13:10:44 +0200
+
ruby-rack-session (2.1.0-1) unstable; urgency=medium
* New upstream version 2.1.0.
diff -Nru ruby-rack-session-2.1.0/lib/rack/session/pool.rb
ruby-rack-session-2.1.1/lib/rack/session/pool.rb
--- ruby-rack-session-2.1.0/lib/rack/session/pool.rb 2025-01-04
08:40:54.000000000 +0100
+++ ruby-rack-session-2.1.1/lib/rack/session/pool.rb 2025-05-06
12:54:57.000000000 +0200
@@ -53,6 +53,7 @@
def write_session(req, session_id, new_session, options)
@mutex.synchronize do
+ return false unless get_session_with_fallback(session_id)
@pool.store session_id.private_id, new_session
session_id
end
@@ -62,7 +63,12 @@
@mutex.synchronize do
@pool.delete(session_id.public_id)
@pool.delete(session_id.private_id)
- generate_sid(use_mutex: false) unless options[:drop]
+
+ unless options[:drop]
+ sid = generate_sid(use_mutex: false)
+ @pool.store(sid.private_id, {})
+ sid
+ end
end
end
diff -Nru ruby-rack-session-2.1.0/lib/rack/session/version.rb
ruby-rack-session-2.1.1/lib/rack/session/version.rb
--- ruby-rack-session-2.1.0/lib/rack/session/version.rb 2025-01-04
08:40:54.000000000 +0100
+++ ruby-rack-session-2.1.1/lib/rack/session/version.rb 2025-05-06
12:54:57.000000000 +0200
@@ -5,6 +5,6 @@
module Rack
module Session
- VERSION = "2.1.0"
+ VERSION = "2.1.1"
end
end
diff -Nru ruby-rack-session-2.1.0/releases.md
ruby-rack-session-2.1.1/releases.md
--- ruby-rack-session-2.1.0/releases.md 2025-01-04 08:40:54.000000000 +0100
+++ ruby-rack-session-2.1.1/releases.md 2025-05-06 12:54:57.000000000 +0200
@@ -1,5 +1,9 @@
# Releases
+## v2.1.1
+
+ - Prevent `Rack::Session::Pool` from recreating deleted sessions
[CVE-2025-46336](https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj).
+
## v2.1.0
- Improved compatibility with Ruby 3.3+ and Rack 3+.
diff -Nru ruby-rack-session-2.1.0/test/spec_session_pool.rb
ruby-rack-session-2.1.1/test/spec_session_pool.rb
--- ruby-rack-session-2.1.0/test/spec_session_pool.rb 2025-01-04
08:40:54.000000000 +0100
+++ ruby-rack-session-2.1.1/test/spec_session_pool.rb 2025-05-06
12:54:57.000000000 +0200
@@ -288,4 +288,52 @@
res = Rack::MockRequest.new(app).get("/")
res["Set-Cookie"].must_be_nil
end
+
+ user_id_session = Rack::Lint.new(lambda do |env|
+ session = env["rack.session"]
+
+ case env["PATH_INFO"]
+ when "/login"
+ session[:user_id] = 1
+ when "/logout"
+ if session[:user_id].nil?
+ raise "User not logged in"
+ end
+
+ session.delete(:user_id)
+ session.options[:renew] = true
+ when "/slow"
+ Fiber.yield
+ end
+
+ Rack::Response.new(session.inspect).to_a
+ end)
+
+ it "doesn't allow session id to be reused" do
+ app = Rack::Session::Pool.new(user_id_session)
+
+ login_response = Rack::MockRequest.new(app).get("/login")
+ login_cookie = login_response["Set-Cookie"]
+
+ slow_request = Fiber.new do
+ Rack::MockRequest.new(app).get("/slow", "HTTP_COOKIE" => login_cookie)
+ end
+ slow_request.resume
+
+ # Check that the session is valid:
+ response = Rack::MockRequest.new(app).get("/", "HTTP_COOKIE" =>
login_cookie)
+ response.body.must_equal({"user_id" => 1}.to_s)
+
+ logout_response = Rack::MockRequest.new(app).get("/logout", "HTTP_COOKIE"
=> login_cookie)
+ logout_cookie = logout_response["Set-Cookie"]
+
+ # Check that the session id is different after logout:
+ login_cookie[session_match].wont_equal logout_cookie[session_match]
+
+ slow_response = slow_request.resume
+
+ # Check that the cookie can't be reused:
+ response = Rack::MockRequest.new(app).get("/", "HTTP_COOKIE" =>
login_cookie)
+ response.body.must_equal "{}"
+ end
end
--- End Message ---
--- Begin Message ---
Unblocked.
--- End Message ---
