-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Package : ruby-rack Version : 1.5.2-3+deb8u3 CVE ID : CVE-2020-8161
There was a possible directory traversal vulnerability in the Rack::Directory app that is bundled with Rack. If certain directories exist in a director that is managed by `Rack::Directory`, an attacker could, using this vulnerability, read the contents of files on the server that were outside of the root specified in the Rack::Directory initializer. For Debian 8 "Jessie", this problem has been fixed in version 1.5.2-3+deb8u3. We recommend that you upgrade your ruby-rack packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Best, Utkarsh -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAl7IGsYACgkQgj6WdgbD S5Zb/xAAjftceQVyFQyKF6APL0SYqnQGLynvaoQLVkQy613TFOzA9n48u4tz+hAK 5rXajhs9as9V9X7GGQdbgFmwZXCYzQGXJ2/7f1BemnVj8sXkrRFF2Uie7OVb46rz qOt9aNfUiMJBVs2ijS104dFNtIeUyHDyGq9aU6WKMHdqm6qyMb2uJCiuR4Kk9al2 5rPYvAg96BlM8DuNIQm+3523rwLf7SI1N9wl+M1kK0plWfHlmzcxrPJlLrnBs8GQ +2TLHaAeeNIH9mlsRDtnPI6uRIkYONFQMzQkxXVjLhUipEfdO7rPWbqXOYaUYvQ6 5HSTcrgNxGoLmHagVnM1jIGjHd0oXljZO1IuY7XURZ3caPgtaeHxh+By4eNJwmEh aX3q0noJDTbhJZrWiVUr2OP5oFoZufkCRSLhKng87LjI9xvKELWHgmMiDfKRg195 ZblXafj5rbUcfFw27Ejrp0hav1FkP4O0SdEk24kplWgjCRYfg9mFrti5QmEdxU0Q pZF9XOIMi2UJHx3a21i0Z9dUwPSd6P3Astca/KDpqmQaCs/duNTPGDMD75pJe9qj 2XxcrhNrhjRD0UkQuWhxx1LcPWlz1XKCUhI12gpnsfBH+FLdBEIeP70t5BsxJNaI deNVyDfs5n2HyQvKEIunkaqrUyUm8+YjENvMEM0a7euLg2y/WYI= =ORAx -----END PGP SIGNATURE-----