==========================================================================
Ubuntu Security Notice USN-7366-2
July 23, 2025

ruby-rack vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.04

Summary:

Several security issues were fixed in Rack.

Software Description:
- ruby-rack: modular Ruby webserver interface

Details:

USN-7366-1 fixed vulnerabilities in Rack. This update provides the
corresponding updates for Ubuntu 25.04.

Original advisory details:

 Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
 remote attacker could possibly use this issue to perform CRLF injection.
 (CVE-2025-25184)

 Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
 remote attacker could possibly use this issue to perform log injection.
 (CVE-2025-27111)

 Phạm Quang Minh discovered that Rack did not properly handle relative file
 paths. A remote attacker could potentially exploit this to include local
 files that should have been inaccessible. (CVE-2025-27610)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
  ruby-rack                       2.2.7-1.1ubuntu0.25.04.2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7366-2
  https://ubuntu.com/security/notices/USN-7366-2
  CVE-2025-25184, CVE-2025-27111, CVE-2025-27610

Package Information:
  https://launchpad.net/ubuntu/+source/ruby-rack/2.2.7-1.1ubuntu0.25.04.2