[ubuntu/noble-security] ruby-webrick 1.8.1-1ubuntu0.2 (Accepted)

[Marc Deslauriers]

ruby-webrick (1.8.1-1ubuntu0.2) noble-security; urgency=medium

  * SECURITY UPDATE: read_header HTTP Request Smuggling Vulnerability
    - debian/patches/CVE-2025-6442-pre1.patch: fix ReDoS parse_header in
      lib/webrick/httputils.rb.
    - debian/patches/CVE-2025-6442-pre2.patch: fix ReDoS split_header_value
      in lib/webrick/httputils.rb.
    - debian/patches/CVE-2025-6442-pre3.patch: merge multiple cookie
      headers, preserving semantic correctness in
      lib/webrick/httprequest.rb, lib/webrick/httputils.rb,
      test/webrick/test_httprequest.rb.
    - debian/patches/CVE-2025-6442.patch: require CRLF line endings in
      request line and headers in lib/webrick/httprequest.rb,
      lib/webrick/httputils.rb, test/webrick/test_filehandler.rb,
      test/webrick/test_httprequest.rb.
    - CVE-2025-6442

Date: 2025-08-14 19:53:20.362571+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/ruby-webrick/1.8.1-1ubuntu0.2
-------------- next part --------------
Sorry, changesfile not available.