www/rubygem-rack16: Update comment7e8e84ad7f
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.
Port details
www/rubygem-rack161.6.13
Rack, a modular Ruby web server interface
- Maintainer
- sunpoet@FreeBSD.org
- Packages
- rubygem-rack16 1.6.13
- Upstream
- up to date
- CPE
rack_project:rackfrom the port- WWW
- https://github.com/rack/rack
- Links
- cgit · VuXML
Unaddressed (4) · The CVE record lists this version as affected, no VuXML entry names the CVE
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
VuXML only (3) · listed, port not fixed yet
rack -- possible denial of service vulnerability in header parsingentered 2023-03-24
rack -- possible DoS vulnerability in multipart MIME parsingentered 2023-03-06
rack -- Multiple vulnerabilitiesentered 2023-01-19
Fixed (2)
VuXML entries whose affected range this version has left.
rack -- information leak / session hijack vulnerabilityentered 2019-12-29
rubygem-rails -- multiple vulnerabilitiesentered 2015-06-17
CVE-2015-1840, CVE-2015-3224, CVE-2015-3225, CVE-2015-3226, CVE-2015-3227
Commits (26)
www/rubygem-rack16: Update COMMENTe57203b6f3
*/*: Change webserver to web server in COMMENT and descriptions Change it for consistency and to make finding packages easier Approved by: portmgr (blanket)0c39e5b312
Mk/**ruby.mk: Switch from USE_RUBY=yes to USES=ruby
Switch from Mk/bsd.ruby.mk to Mk/Uses/ruby.mk
Notable changes are.
- Mk/bsd.ruby.mk is moved to Mk/Uses/ruby.mk.
- USE_RUBY=yes is replaced with USES=ruby.
- USE_RUBY_EXTCONF is replaced with USES=ruby:extconf.
- USE_RUBY_RDOC is replaced with USES=ruby:rdoc.
- USE_RUBY_SETUP is replaces with USES=ruby:setup.
- RUBY_NO_BUILD_DEPENDS and RUBY_NO_RUN_DEPENDS are replaced with
USES=ruby:{build,none,run}.
- RUBY_REQUIRE isn't used anywhere, so removed.
- USES=gem now implies USES=ruby.
This is mainly the work of yasu@ at https://reviews.freebsd.org/D27863
I have just made some cosmetic changes and ran exp-run to test that the
tree is not in a BROKEN state.
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D3792518c6e18276Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
www/rubygem-rack16: Cosmetic change152d7bb909
www/rubygem-rack16: Add CPE information Approved by: portmgr (blanket)b4bc9596b8
One more small cleanup, forgotten yesterday. Reported by: lwhsucf118ccf87
Remove # $FreeBSD$ from Makefiles.305f148f48
Update to 1.6.13 Changes: https://github.com/rack/rack/commits/1-6-stable2564df6e5d
Update to 1.6.12 - Update pkg-descr - Update WWW - Take maintainership Changes: https://github.com/rack/rack/blob/master/CHANGELOG.md Security: 66e4dc99-28b3-11ea-8dde-08002728f74c20966c9c41
Update to 1.6.11 Changes: https://github.com/rack/rack/commits/1-6-stablea8a705776a
Update to 1.6.10 Changes: https://github.com/rack/rack/commits/1-6-stable0fdd2e5fab
Update to 1.6.9 Changes: https://github.com/rack/rack/commits/1-6-stableea150b57e1
Update to 1.6.8 Changes: https://github.com/rack/rack/commits/1-6-stablec02c4a941d
Update to 1.6.7 Changes: https://github.com/rack/rack/commits/1-6-stable2e9e925f81
Update to 1.6.6 Changes: https://github.com/rack/rack/commits/1-6-stablee370f1e8ce
- Update to 1.6.5 Changes: https://github.com/rack/rack/blob/master/HISTORY.md https://github.com/rack/rack/commits/1-6-stable33060c0161
Convert USES=gem:autoplist to USES=gem since autoplist is default462519941e
create USES=gem and update rubygem- ports to use it Note that for now ports still have to have USE_RUBY=yes to use USES=gem PR: 209041 Differential Revision: https://reviews.freebsd.org/D6070b3e8fe8d85
- Update to 1.6.4 Changes: https://github.com/rack/rack/blob/master/HISTORY.md https://github.com/rack/rack/commits/1-6-stable49738e9b8d
- Update to 1.6.3 Changes: https://github.com/rack/rack/blob/master/HISTORY.md https://github.com/rack/rack/commits/1-6-stable2bef947ccd
- Update to 1.6.2 Changes: https://github.com/rack/rack/blob/master/HISTORY.md Security: eb8a8978-8dd5-49ce-87f4-49667b2166dd Security: CVE-2015-3225173814d358
- Add NO_ARCH - Update comment - Cosmetic change - Fix WWWb7124c0e58
www/rubygem-rails4: update to 4.2.1 Differential Revision: https://reviews.freebsd.org/D271083c258ba8a