Added two Rack vulnerabilities#1000
Conversation
postmodern
left a comment
postmodern
left a comment
There was a problem hiding this comment.
YAML formatting is a bit off.
gems/rack/CVE-2026-22860.yml
Outdated
| url: https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh | ||
| title: Rack has a Directory Traversal via Rack:Directory | ||
| date: 2026-02-17 | ||
| description: "## Summary\n\n`Rack::Directory`’s path check used a string prefix match |
There was a problem hiding this comment.
description: should be block text, not a quoted string. It appears that code blocks can confuse YAML's formatting.
gems/rack/CVE-2026-22860.yml
Outdated
| patched_versions: | ||
| - "~> 2.2.22" | ||
| - "~> 3.1.20" | ||
| - ">= 3.2.5" |
There was a problem hiding this comment.
YAML Array elements should be indented by two spaces.
gems/rack/CVE-2026-22860.yml
Outdated
| url: | ||
| - https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh | ||
| - https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7 | ||
| - https://github.com/advisories/GHSA-mxw3-3hh2-x2mh |
There was a problem hiding this comment.
YAML Array elements should be indented by two spaces.
gems/rack/CVE-2026-25500.yml
Outdated
| patched_versions: | ||
| - "~> 2.2.22" | ||
| - "~> 3.1.20" | ||
| - ">= 3.2.5" |
There was a problem hiding this comment.
YAML Array elements should be indented by two spaces.
gems/rack/CVE-2026-25500.yml
Outdated
| url: | ||
| - https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp | ||
| - https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff | ||
| - https://github.com/advisories/GHSA-whrj-4476-wvmp |
There was a problem hiding this comment.
YAML Array elements should be indented by two spaces.
|
Known issue - hopefully the GHSA sync script could be changed to make this problem go away. |
jamgregory
force-pushed
the
rack-vulns
branch
from
37c25a3 to
781b725
Compare
|
Thanks for the review @postmodern. I'd just gone with what the sync script had generated because it looked correct at the time, but I've updated them to match the expected style so hopefully they're correct now 🤞 |
|
Run "yamllint" and "rake" is what I use to check. |
3 participants
I've added two new Rack vulnerabilities that GitHub security scanning has alerted me to.
Hopefully these files are OK (they've passed the required tests)