Fixed @ CVE-2022-30123

[mik-patient]

Vulnerability Description

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Arbitrary Code Injection. There is a possible shell-escape sequence injection vulnerability in Rack's Lint and CommonLogger components. Carefully crafted requests can cause shell escape sequences to be written to the terminal via Rack's Lint middleware and CommonLogger middleware. These escape sequences can be leveraged to possibly execute commands in the victim's terminal.

Notes:
Impacted applications will have either of these middleware installed, and vulnerable apps may have something like this:use Rack::Lint or use Rack::CommonLogger.

CVE-2022-30123
GHSA-wq4h-7r42-5hrr

Technical Details

Testing Instructions

[WilliamNHarvey]

👋 Hey there

This change to the Gemfile.lock won't affect the apps that use this gem. It's solely committed here for use in automated testing. Is there a change to the gemspec that's relevant to this CVE, like new minimum dependency versions?