USN-7507-1

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-7507-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7507-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/USN-7507-1

Related

Published

2025-05-12T13:03:34.076059Z

Modified

2025-05-12T13:03:34.076059Z

Summary

ruby-rack vulnerabilities

Details

It was discovered that Rack incorrectly handled deleted rack sessions. An attacker could possibly use this issue to expose sensitive information or to gain unauthorized access to user accounts. (CVE-2025-32441)

It was discovered that Rack incorrectly limited the number of parameters in a web request. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-46727)

References

Affected packages

Ubuntu:Pro:14.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@1.5.2-3+deb8u3ubuntu1~esm10?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.2-3+deb8u3ubuntu1~esm10

Affected versions

1.*

1.5.2-1

1.5.2-1ubuntu0.1~esm1

1.5.2-3+deb8u3ubuntu1~esm2

1.5.2-3+deb8u3ubuntu1~esm3

1.5.2-3+deb8u3ubuntu1~esm4

1.5.2-3+deb8u3ubuntu1~esm6

1.5.2-3+deb8u3ubuntu1~esm7

1.5.2-3+deb8u3ubuntu1~esm8

1.5.2-3+deb8u3ubuntu1~esm9

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm10",
            "binary_name": "librack-ruby"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm10",
            "binary_name": "librack-ruby1.8"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm10",
            "binary_name": "librack-ruby1.9.1"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm10",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@1.6.4-3ubuntu0.2+esm8?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.4-3ubuntu0.2+esm8

Affected versions

1.*

1.5.2-4

1.6.4-2

1.6.4-3

1.6.4-3ubuntu0.1

1.6.4-3ubuntu0.2

1.6.4-3ubuntu0.2+esm1

1.6.4-3ubuntu0.2+esm2

1.6.4-3ubuntu0.2+esm4

1.6.4-3ubuntu0.2+esm5

1.6.4-3ubuntu0.2+esm6

1.6.4-3ubuntu0.2+esm7

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.6.4-3ubuntu0.2+esm8",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@1.6.4-4ubuntu0.2+esm8?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.4-4ubuntu0.2+esm8

Affected versions

1.*

1.6.4-4

1.6.4-4ubuntu0.1

1.6.4-4ubuntu0.2

1.6.4-4ubuntu0.2+esm1

1.6.4-4ubuntu0.2+esm2

1.6.4-4ubuntu0.2+esm4

1.6.4-4ubuntu0.2+esm5

1.6.4-4ubuntu0.2+esm6

1.6.4-4ubuntu0.2+esm7

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.6.4-4ubuntu0.2+esm8",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:20.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@2.0.7-2ubuntu0.1+esm7?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.7-2ubuntu0.1+esm7

Affected versions

2.*

2.0.6-3

2.0.7-2

2.0.7-2ubuntu0.1

2.0.7-2ubuntu0.1+esm1

2.0.7-2ubuntu0.1+esm2

2.0.7-2ubuntu0.1+esm3

2.0.7-2ubuntu0.1+esm4

2.0.7-2ubuntu0.1+esm5

2.0.7-2ubuntu0.1+esm6

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "2.0.7-2ubuntu0.1+esm7",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:22.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@2.1.4-5ubuntu1.1+esm2?arch=source&distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.4-5ubuntu1.1+esm2

Affected versions

2.*

2.1.4-3

2.1.4-4

2.1.4-5

2.1.4-5ubuntu1

2.1.4-5ubuntu1+esm2

2.1.4-5ubuntu1+esm3

2.1.4-5ubuntu1+esm4

2.1.4-5ubuntu1+esm5

2.1.4-5ubuntu1.1

2.1.4-5ubuntu1.1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "2.1.4-5ubuntu1.1+esm2",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:24.10 / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@2.2.7-1.1ubuntu0.2?arch=source&distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.7-1.1ubuntu0.2

Affected versions

2.*

2.2.7-1

2.2.7-1.1

2.2.7-1.1ubuntu0.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.2.7-1.1ubuntu0.2",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:24.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@2.2.7-1ubuntu0.3?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.7-1ubuntu0.3

Affected versions

2.*

2.2.4-3

2.2.7-1

2.2.7-1ubuntu0.1

2.2.7-1ubuntu0.2

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.2.7-1ubuntu0.3",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:25.04 / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@2.2.7-1.1ubuntu0.25.04.1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.7-1.1ubuntu0.25.04.1

Affected versions

2.*

2.2.7-1.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.2.7-1.1ubuntu0.25.04.1",
            "binary_name": "ruby-rack"
        }
    ]
}