[From nobody Sun Oct 11 12:55:07 2026 Received: (at 1143080-close) by bugs.debian.org; 11 Oct 2026 11:52:27 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 139; hammy, 150; neutral, 272; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:33300) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6O-00AmJI-0x for 1143080-close@bugs.debian.org; Sun, 11 Oct 2026 11:52:27 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6N-002b7E-1r for 1143080-close@bugs.debian.org; Sun, 11 Oct 2026 11:52:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=hre00qLc7/wK7atHYDsBKjV/sDltGbWoubLRp6pWsPY=; b=qLdtDJ0b8VsyGhUuFkFjoyUyZx 6K1Nm3fyNrVWTaus8PBMFAXVV2fsGeHl2J1JwWeL19qkNzd8TUFPSQ48KoGVTk4FsqrWWPsVrgG7S PNZxHYZHRVvti5RzLXNpX1DmUFtpWjV7Q3dO3cFMBzd0UaiZ7XEtxXxomKdCG2IjRLU3HmNU+IUWF xycKDScHvkogXzgHtH/PTY0JxADCV1+L2gUMlppywkjZSchSPMMl0WlW5TC3F9od95xiFGswZ7NXH m9rGGqFuP4Fi+1J6Ki3GwEPv6gL1NiU258/abhBU2iKfHNeb8SV+p0t7JOCemO3kH4ObZe40WM9um pZqAkp1g==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6M-00000007GqD-3FEr; Sun, 11 Oct 2026 11:52:26 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Simon Quigley <tsimonq2@debian.org> To: 1143080-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: rails Debian: DAK Debian-Changes: rails_7.2.2.2+dfsg-2~deb13u2_source.changes Debian-Source: rails Debian-Version: 2:7.2.2.2+dfsg-2~deb13u2 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1143080: fixed in rails 2:7.2.2.2+dfsg-2~deb13u2 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============0261836313526396071==" Message-Id: <E1xFs6M-00000007GqD-3FEr@fasolo.debian.org> Date: Sun, 11 Oct 2026 11:52:26 +0000 --===============0261836313526396071== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: rails Source-Version: 2:7.2.2.2+dfsg-2~deb13u2 Done: Simon Quigley <tsimonq2@debian.org> We believe that the bug you reported is fixed in the latest version of rails, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1143080@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Simon Quigley <tsimonq2@debian.org> (supplier of updated rails package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 04 Oct 2026 16:13:12 -0500 Source: rails Architecture: source Version: 2:7.2.2.2+dfsg-2~deb13u2 Distribution: trixie-security Urgency: high Maintainer: Debian Ruby Team <pkg-ruby-extras-maintainers@lists.alioth.debian= .org> Changed-By: Simon Quigley <tsimonq2@debian.org> Closes: 1132035 1143080 Changes: rails (2:7.2.2.2+dfsg-2~deb13u2) trixie-security; urgency=3Dhigh . * CVE-2026-66066: disable libvips unfuzzed loaders and savers when Active Storage loads ruby-vips. BMP, ICO, and PSD variants then raise Vips::Error (Closes: #1143080). * CVE-2026-33168: skip blank HTML attribute names in tag helpers. A blank attribute name bypasses escaping and produces malformed HTML. A crafted value can be read as a separate attribute, possibly leading to XSS (Closes: #1132035). * CVE-2026-33169: delimit numbers without the backtracking expression. The lookahead regular expression and gsub! can take quadratic time on a long digit string (Closes: #1132035). * CVE-2026-33170: keep an unsafe SafeBuffer unsafe after %. SafeBuffer#% does not copy the html_safe flag. Formatting a buffer mutated in place, with untrusted arguments, reports html_safe? and bypasses ERB escaping (Closes: #1132035). * CVE-2026-33173: drop analyzed, identified, and composed from direct uploads. Direct upload metadata can set those flags, skip MIME detection, and claim a safe content_type for other content (Closes: #1132035). * CVE-2026-33174: reject Active Storage byte ranges larger than 100MB. The proxy loads the whole requested byte range into memory. A large or unbounded Range header can exhaust memory. Ranges whose total size reaches 100MB are now rejected (Closes: #1132035). * CVE-2026-33176: do not expand scientific notation in number helpers. Strings such as 1e10000 are expanded by BigDecimal into a huge representation, which can exhaust memory and CPU (Closes: #1132035). * CVE-2026-33195: reject disk keys that leave the Active Storage root. DiskService#path_for does not keep the resolved path inside the storage root. A key containing ../ can read, write, or delete files outside it (Closes: #1132035). * CVE-2026-33202: escape glob metacharacters in DiskService#delete_prefixed. The prefix is passed to Dir.glob without escaping. A key containing glob metacharacters can delete a different file (Closes: #1132035). * CVE-2026-33658: allow only one byte range on Active Storage proxies. The proxy does not limit how many ranges a Range header may contain. Thousands of small ranges use much more CPU than one request for the same file (Closes: #1132035). Checksums-Sha1: 647af4aab1c6a55b60b9cb720554baa4e9c944c5 4704 rails_7.2.2.2+dfsg-2~deb13u2.d= sc e1ce8744c85847eaf81dffb1c2436271dc3c43ec 115212 rails_7.2.2.2+dfsg-2~deb13u2= .debian.tar.xz 01c194615a2b4599d171f1c019a63dc39f1148db 21120 rails_7.2.2.2+dfsg-2~deb13u2_= source.buildinfo Checksums-Sha256: 2a17eb5a9c943ebf358525e1d170a1b93f685f7e657f5ad539871b513789b6c3 4704 rails_= 7.2.2.2+dfsg-2~deb13u2.dsc 33bf3623384401509bfc0a48ea864bdea8eae245a053cdf2789b37dd67688ab6 115212 rail= s_7.2.2.2+dfsg-2~deb13u2.debian.tar.xz b7d493a01e645b18147a6e8194b12d85e7b67e731a22b170870e04389344e1d2 21120 rails= _7.2.2.2+dfsg-2~deb13u2_source.buildinfo Files: 26717cee511e673179ec708f9bf360bc 4704 ruby optional rails_7.2.2.2+dfsg-2~deb= 13u2.dsc 0507b6a8774496ada3dd0c1e29e0fc88 115212 ruby optional rails_7.2.2.2+dfsg-2~d= eb13u2.debian.tar.xz 70c96df2535b35d71d39989eaf15bb85 21120 ruby optional rails_7.2.2.2+dfsg-2~de= b13u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrD7SQACgkQ4n8s+EWM L6RDqA/9HhKKHzM9HRRtGTQM49Lk5WJZaCH/dGWZLnd4zbWAdyKVoanGvtIzg3P+ 8j1Ax2kvLiH44n0fsJkZIwxhT0+98AvxvP7PBa3CgITvrCva/DMAoQ1E5yDGtL6p 4uWtjsIwhkS55vmrePgTUpnR2cEVLxQnLFTHoMKjJvbYZ+g5W2vzRn0L0xnFeDvm eVf4fyc/Ukx3bQgl8j++D1NUg0/UFqlUQZUcxQhtv0uRqXGN3tdQ6DSrK/bSJBLP aUlaSAeLMxnJTqxuZQkYqyC5knVH16NHBF0E3glcyB2mbIO2TiSttDvlv9XF2MAP gUPWqlmI8N1TaW/O9+b4Nlw6iluQsEajRmSx4iJlKn3l8luv08H8wkQEdwI/gayD 5JGMPQ1vdt61JQ6IreI6jHyF5pAyrlQ7srxxsa7pnIDw2OtlNuKSZuWgfvl+dZn4 6vba5u+bIj3OLxFnkbE3Pkh0kRbXf6GQtB/z1/vfKRSHBCBTUHAn/VkehOPOlfG+ la9uSt7HnnNULi6SdHFWwr5xibxYS3McMed3mI/6jGFpTldVlTL5/F7ZZlVU12ta CmBod/bpfYcjSxeJl5458nyGD1kyW6DHIdrZjGlU3NZIpZzTgy+IEB6bvAZuTGW1 g91oPvGtJ9SDPQ+/dAfSqYtqT9A/DnT2EyNhUTTh2RKKW8RxqFs=3D =3DCF6D -----END PGP SIGNATURE----- --===============0261836313526396071== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCast4egAKCRCb9qggYcy5 Ib4TAQDEJdtlisQ0PPIUw6Js/3U9rRmPT77IPsuWnLNtRcnCtQD/UTpAbRzZFyS0 AF+0sOeC5ccrHEFt1lV9ryV6gKk5+QI= =sb3g -----END PGP SIGNATURE----- --===============0261836313526396071==-- ]