-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4247-1 security@xxxxxxxxxx https://www.debian.org/security/ Moritz Muehlenhoff July 16, 2018 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : ruby-rack-protection CVE ID : CVE-2018-1000119 A timing attack was discovered in the function for CSRF token validation of the "Ruby rack protection" framework. For the stable distribution (stretch), this problem has been fixed in version 1.5.3-2+deb9u1. We recommend that you upgrade your ruby-rack-protection packages. For the detailed security status of ruby-rack-protection please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby-rack-protection Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAltNB3gACgkQEMKTtsN8 TjZVuxAAiKq0P55jJdi5A6mnYovDlWJUPsOQ4dQSxZGFXlXX5VQuvtqPjKzVnVv5 FodnFUbqjrtYogUfocJ6A96hpTJb9A/xQp5v58WI64Y7MEhDn+9aWNvbcIP4aZi6 AuGTrF/9gSL0CKnUYgPjU84nnGJStkc/3JqIKa8Y8YI8G5g2825Z2OGgZCYuZ/wD gihXEEJ0KXBFXedQsVaHsqBpMmyRcBJvV60dX4KzC0RUu4OoRbD/a4gXqNNhJpAf 2kzdqIDSav1C6UuE7K5KYHIB2G/c4OXSb/mzumUnhP6gml4e1eK2D1oCOnyjRaE1 wtUvXV7JX9PZqvEhadHUHs8N9r8apJdXuMsuAjnqmT1irGbOYRiOgAzinnfzDZeb 14BRQ21qd4+lZVWd0HV7b4ikJlGBIVK5tFksywSrbpoO2qYIkJzOZ8uHKFQgjyO3 KzSufToi7YbIsuj6ow+JvIIi0J+3voxO1sl/Z3GcTL2fOnGpQPQbS1nVs3qqk0WY JOTgwNwbEa0PD6dH/CneFOaKwEYB+CeZ9iSMyJ93PhLou2sjKRaQ+Zg3G9ajserS pA6MHwrYNRVP6Tj86Me3MX4wHJZYqscsljv9B/xf8rn1Fulys9cyN12wiDpohjzC VJEGKbtGbmh6S6qKPOzRTSY3oqbl+1gjg+K0WhB9eJivgU/mXOI= =9IxN -----END PGP SIGNATURE-----
