Hello community, here is the log from the commit of package rubygem-rack for openSUSE:Factory checked in at 2020-06-19 17:26:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rubygem-rack (Old) and /work/SRC/openSUSE:Factory/.rubygem-rack.new.3606 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-rack" Fri Jun 19 17:26:10 2020 rev:19 rq:815944 version:2.2.3 Changes: -------- --- /work/SRC/openSUSE:Factory/rubygem-rack/rubygem-rack.changes 2020-03-07 21:40:57.112382074 +0100 +++ /work/SRC/openSUSE:Factory/.rubygem-rack.new.3606/rubygem-rack.changes 2020-06-19 17:26:36.400456387 +0200 @@ -1,0 +2,10 @@ +Thu Jun 18 14:24:12 UTC 2020 - Eduardo Navarro <[email protected]> + +- updated to version 2.2.3 + see installed CHANGELOG.md + + ## [2.2.3] - 2020-06-15 + + [CVE-2020-8184] Only decode cookie values + +------------------------------------------------------------------- Old: ---- rack-2.2.2.gem New: ---- rack-2.2.3.gem ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rubygem-rack.spec ++++++ --- /var/tmp/diff_new_pack.lyT0it/_old 2020-06-19 17:26:37.384459297 +0200 +++ /var/tmp/diff_new_pack.lyT0it/_new 2020-06-19 17:26:37.388459309 +0200 @@ -24,7 +24,7 @@ # Name: rubygem-rack -Version: 2.2.2 +Version: 2.2.3 Release: 0 %define mod_name rack %define mod_full_name %{mod_name}-%{version} ++++++ rack-2.2.2.gem -> rack-2.2.3.gem ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/CHANGELOG.md new/CHANGELOG.md --- old/CHANGELOG.md 2020-02-10 23:24:40.000000000 +0100 +++ new/CHANGELOG.md 2020-06-16 00:22:45.000000000 +0200 @@ -2,6 +2,10 @@ All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/). +## [2.2.3] - 2020-02-11 + +- [CVE-2020-8184] Only decode cookie values + ## [2.2.2] - 2020-02-11 ### Fixed diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SPEC.rdoc new/SPEC.rdoc --- old/SPEC.rdoc 2020-02-10 23:24:40.000000000 +0100 +++ new/SPEC.rdoc 2020-06-16 00:22:45.000000000 +0200 @@ -42,17 +42,18 @@ <tt>QUERY_STRING</tt>:: The portion of the request URL that follows the <tt>?</tt>, if any. May be empty, but is always required! -<tt>SERVER_NAME</tt>, <tt>SERVER_PORT</tt>:: - When combined with <tt>SCRIPT_NAME</tt> and +<tt>SERVER_NAME</tt>:: When combined with <tt>SCRIPT_NAME</tt> and <tt>PATH_INFO</tt>, these variables can be used to complete the URL. Note, however, that <tt>HTTP_HOST</tt>, if present, should be used in preference to <tt>SERVER_NAME</tt> for reconstructing the request URL. - <tt>SERVER_NAME</tt> and <tt>SERVER_PORT</tt> - can never be empty strings, and so - are always required. + <tt>SERVER_NAME</tt> can never be an empty + string, and so is always required. +<tt>SERVER_PORT</tt>:: An optional +Integer+ which is the port the + server is running on. Should be specified if + the server is running on a non-standard port. <tt>HTTP_</tt> Variables:: Variables corresponding to the client-supplied HTTP request headers (i.e., variables whose @@ -122,6 +123,9 @@ is reserved for use with the Rack core distribution and other accepted specifications and must not be used otherwise. +The <tt>SERVER_PORT</tt> must be an Integer if set. +The <tt>SERVER_NAME</tt> must be a valid authority as defined by RFC7540. +The <tt>HTTP_HOST</tt> must be a valid authority as defined by RFC7540. The environment must not contain the keys <tt>HTTP_CONTENT_TYPE</tt> or <tt>HTTP_CONTENT_LENGTH</tt> (use the versions without <tt>HTTP_</tt>). Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/rack/utils.rb new/lib/rack/utils.rb --- old/lib/rack/utils.rb 2020-02-10 23:24:40.000000000 +0100 +++ new/lib/rack/utils.rb 2020-06-16 00:22:45.000000000 +0200 @@ -212,8 +212,12 @@ # The syntax for cookie headers only supports semicolons # User Agent -> Server == # Cookie: SID=31d4d96e407aad42; lang=en-US - cookies = parse_query(header, ';') { |s| unescape(s) rescue s } - cookies.each_with_object({}) { |(k, v), hash| hash[k] = Array === v ? v.first : v } + return {} unless header + header.split(/[;] */n).each_with_object({}) do |cookie, cookies| + next if cookie.empty? + key, value = cookie.split('=', 2) + cookies[key] = (unescape(value) rescue value) unless cookies.key?(key) + end end def add_cookie_to_header(header, key, value) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/rack/version.rb new/lib/rack/version.rb --- old/lib/rack/version.rb 2020-02-10 23:24:40.000000000 +0100 +++ new/lib/rack/version.rb 2020-06-16 00:22:45.000000000 +0200 @@ -20,7 +20,7 @@ VERSION.join(".") end - RELEASE = "2.2.2" + RELEASE = "2.2.3" # Return the Rack release as a dotted string. def self.release diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/metadata new/metadata --- old/metadata 2020-02-10 23:24:40.000000000 +0100 +++ new/metadata 2020-06-16 00:22:45.000000000 +0200 @@ -1,14 +1,14 @@ --- !ruby/object:Gem::Specification name: rack version: !ruby/object:Gem::Version - version: 2.2.2 + version: 2.2.3 platform: ruby authors: - Leah Neukirchen -autorequire: +autorequire: bindir: bin cert_chain: [] -date: 2020-02-10 00:00:00.000000000 Z +date: 2020-06-15 00:00:00.000000000 Z dependencies: - !ruby/object:Gem::Dependency name: minitest @@ -169,7 +169,7 @@ changelog_uri: https://github.com/rack/rack/blob/master/CHANGELOG.md documentation_uri: https://rubydoc.info/github/rack/rack source_code_uri: https://github.com/rack/rack -post_install_message: +post_install_message: rdoc_options: [] require_paths: - lib @@ -184,8 +184,8 @@ - !ruby/object:Gem::Version version: '0' requirements: [] -rubygems_version: 3.0.6 -signing_key: +rubygems_version: 3.2.0.pre1 +signing_key: specification_version: 4 summary: A modular Ruby webserver interface. test_files: []
