Commit f6c9613
CHEF-28294: Fix CVE-2025-61780 - Update rack gem constraint to >= 3.1.18
Update rack gem version constraint in oc-id Gemfile from '> 3.0' to '>= 3.1.18'
to address CVE-2025-61780 (CVSS 5.3), an information disclosure vulnerability
in Rack::Sendfile when running behind a proxy like Nginx.
The vulnerability affects rack versions prior to 2.2.20, 3.1.18, and 3.2.3.
Gemfile.lock already contains rack 3.2.3 which is compliant.1 parent 5cde9ab commit f6c9613
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
32 | | - | |
| 32 | + | |
33 | 33 | | |
34 | 34 | | |
35 | 35 | | |
| |||
0 commit comments