diff --git a/bundle-audit-time.txt b/bundle-audit-time.txt index 2a8d57b..d447b81 100644 --- a/bundle-audit-time.txt +++ b/bundle-audit-time.txt @@ -1 +1 @@ -2025-03-06T11:25:00+01:00 +2025-03-06T11:26:07+01:00 diff --git a/bundle-audit.json b/bundle-audit.json index f07d123..41645d5 100644 --- a/bundle-audit.json +++ b/bundle-audit.json @@ -1 +1 @@ -{"version":"0.9.2","created_at":"2025-03-06 11:25:00 +0100","results":[{"type":"unpatched_gem","gem":{"name":"rack","version":"3.1.10"},"advisory":{"path":"/home/wiseadvice/.local/share/ruby-advisory-db/gems/rack/CVE-2025-27111.yml","id":"CVE-2025-27111","url":"https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v","title":"Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection","date":"2025-03-04","description":"## Summary\n\n`Rack::Sendfile` can be exploited by crafting input that\nincludes newline characters to manipulate log entries.\n\n## Details\n\nThe `Rack::Sendfile` middleware logs unsanitized header values from\nthe `X-Sendfile-Type` header. An attacker can exploit this by\ninjecting escape sequences (such as newline characters) into the\nheader, resulting in log injection.\n\n## Impact\n\nThis vulnerability can distort log files, obscure\nattack traces, and complicate security auditing.\n\n## Mitigation\n\n- Update to the latest version of Rack, or\n- Remove usage of `Rack::Sendfile`.\n","cvss_v2":null,"cvss_v3":null,"cve":"2025-27111","osvdb":null,"ghsa":"8cgq-6mh2-7j6v","unaffected_versions":[],"patched_versions":["~> 2.2.12","~> 3.0.13",">= 3.1.11"],"criticality":null}}]} \ No newline at end of file +{"version":"0.9.2","created_at":"2025-03-06 11:26:07 +0100","results":[]} \ No newline at end of file diff --git a/report.txt b/report.txt index 750bf61..8900c02 100644 --- a/report.txt +++ b/report.txt @@ -1,10 +1 @@ -Name: rack -Version: 3.1.10 -CVE: CVE-2025-27111 -GHSA: GHSA-8cgq-6mh2-7j6v -Criticality: Unknown -URL: https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v -Title: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection -Solution: update to '~> 2.2.12', '~> 3.0.13', '>= 3.1.11' - -Vulnerabilities found! +No vulnerabilities found diff --git a/update-info.txt b/update-info.txt index 3b4eec2..baf0520 100644 --- a/update-info.txt +++ b/update-info.txt @@ -1,9 +1,5 @@ Updating ruby-advisory-db ... -Updating 6847b45..8ab1b43 -Fast-forward - gems/rack/CVE-2025-27111.yml | 43 +++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 43 insertions(+) - create mode 100644 gems/rack/CVE-2025-27111.yml +Already up to date. Updated ruby-advisory-db ruby-advisory-db: advisories: 965 advisories