Skip to content

Commit f6c9613

Browse files
kalroyjashaik
authored andcommitted
CHEF-28294: Fix CVE-2025-61780 - Update rack gem constraint to >= 3.1.18
Update rack gem version constraint in oc-id Gemfile from '> 3.0' to '>= 3.1.18' to address CVE-2025-61780 (CVSS 5.3), an information disclosure vulnerability in Rack::Sendfile when running behind a proxy like Nginx. The vulnerability affects rack versions prior to 2.2.20, 3.1.18, and 3.2.3. Gemfile.lock already contains rack 3.2.3 which is compliant.
1 parent 5cde9ab commit f6c9613

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/oc-id/Gemfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ gem 'veil', '~> 0.3.11',
2929
git: "https://github.com/talktovikas/chef_secrets.git",
3030
branch: "vikas/debug"
3131

32-
gem 'rack', '> 3.0'
32+
gem 'rack', '>= 3.1.18'
3333

3434
gem 'omniauth-chef', '~> 0.4.1',
3535
git: "https://github.com/talktovikas/omniauth-chef.git",

0 commit comments

Comments
 (0)