[DRE-maint] rails_7.2.2.2+dfsg-2~deb13u2_source.changes ACCEPTED into proposed-updates

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 04 Oct 2026 16:13:12 -0500
Source: rails
Architecture: source
Version: 2:7.2.2.2+dfsg-2~deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Debian Ruby Team <pkg-ruby-extras-maintainers at lists.alioth.debian.org>
Changed-By: Simon Quigley <tsimonq2 at debian.org>
Closes: 1132035 1143080
Changes:
 rails (2:7.2.2.2+dfsg-2~deb13u2) trixie-security; urgency=high
 .
   * CVE-2026-66066: disable libvips unfuzzed loaders and savers when
     Active Storage loads ruby-vips. BMP, ICO, and PSD variants then
     raise Vips::Error (Closes: #1143080).
   * CVE-2026-33168: skip blank HTML attribute names in tag helpers.
     A blank attribute name bypasses escaping and produces malformed
     HTML. A crafted value can be read as a separate attribute, possibly
     leading to XSS (Closes: #1132035).
   * CVE-2026-33169: delimit numbers without the backtracking expression.
     The lookahead regular expression and gsub! can take quadratic time
     on a long digit string (Closes: #1132035).
   * CVE-2026-33170: keep an unsafe SafeBuffer unsafe after %.
     SafeBuffer#% does not copy the html_safe flag. Formatting a buffer
     mutated in place, with untrusted arguments, reports html_safe? and
     bypasses ERB escaping (Closes: #1132035).
   * CVE-2026-33173: drop analyzed, identified, and composed from
     direct uploads.
     Direct upload metadata can set those flags, skip MIME detection,
     and claim a safe content_type for other content (Closes: #1132035).
   * CVE-2026-33174: reject Active Storage byte ranges larger than 100MB.
     The proxy loads the whole requested byte range into memory. A large
     or unbounded Range header can exhaust memory. Ranges whose total
     size reaches 100MB are now rejected (Closes: #1132035).
   * CVE-2026-33176: do not expand scientific notation in number helpers.
     Strings such as 1e10000 are expanded by BigDecimal into a huge
     representation, which can exhaust memory and CPU (Closes: #1132035).
   * CVE-2026-33195: reject disk keys that leave the Active Storage root.
     DiskService#path_for does not keep the resolved path inside the
     storage root. A key containing ../ can read, write, or delete files
     outside it (Closes: #1132035).
   * CVE-2026-33202: escape glob metacharacters in
     DiskService#delete_prefixed.
     The prefix is passed to Dir.glob without escaping. A key containing
     glob metacharacters can delete a different file (Closes: #1132035).
   * CVE-2026-33658: allow only one byte range on Active Storage proxies.
     The proxy does not limit how many ranges a Range header may contain.
     Thousands of small ranges use much more CPU than one request for the
     same file (Closes: #1132035).
Checksums-Sha1:
 647af4aab1c6a55b60b9cb720554baa4e9c944c5 4704 rails_7.2.2.2+dfsg-2~deb13u2.dsc
 e1ce8744c85847eaf81dffb1c2436271dc3c43ec 115212 rails_7.2.2.2+dfsg-2~deb13u2.debian.tar.xz
 01c194615a2b4599d171f1c019a63dc39f1148db 21120 rails_7.2.2.2+dfsg-2~deb13u2_source.buildinfo
Checksums-Sha256:
 2a17eb5a9c943ebf358525e1d170a1b93f685f7e657f5ad539871b513789b6c3 4704 rails_7.2.2.2+dfsg-2~deb13u2.dsc
 33bf3623384401509bfc0a48ea864bdea8eae245a053cdf2789b37dd67688ab6 115212 rails_7.2.2.2+dfsg-2~deb13u2.debian.tar.xz
 b7d493a01e645b18147a6e8194b12d85e7b67e731a22b170870e04389344e1d2 21120 rails_7.2.2.2+dfsg-2~deb13u2_source.buildinfo
Files:
 26717cee511e673179ec708f9bf360bc 4704 ruby optional rails_7.2.2.2+dfsg-2~deb13u2.dsc
 0507b6a8774496ada3dd0c1e29e0fc88 115212 ruby optional rails_7.2.2.2+dfsg-2~deb13u2.debian.tar.xz
 70c96df2535b35d71d39989eaf15bb85 21120 ruby optional rails_7.2.2.2+dfsg-2~deb13u2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrD7SQACgkQ4n8s+EWM
L6RDqA/9HhKKHzM9HRRtGTQM49Lk5WJZaCH/dGWZLnd4zbWAdyKVoanGvtIzg3P+
8j1Ax2kvLiH44n0fsJkZIwxhT0+98AvxvP7PBa3CgITvrCva/DMAoQ1E5yDGtL6p
4uWtjsIwhkS55vmrePgTUpnR2cEVLxQnLFTHoMKjJvbYZ+g5W2vzRn0L0xnFeDvm
eVf4fyc/Ukx3bQgl8j++D1NUg0/UFqlUQZUcxQhtv0uRqXGN3tdQ6DSrK/bSJBLP
aUlaSAeLMxnJTqxuZQkYqyC5knVH16NHBF0E3glcyB2mbIO2TiSttDvlv9XF2MAP
gUPWqlmI8N1TaW/O9+b4Nlw6iluQsEajRmSx4iJlKn3l8luv08H8wkQEdwI/gayD
5JGMPQ1vdt61JQ6IreI6jHyF5pAyrlQ7srxxsa7pnIDw2OtlNuKSZuWgfvl+dZn4
6vba5u+bIj3OLxFnkbE3Pkh0kRbXf6GQtB/z1/vfKRSHBCBTUHAn/VkehOPOlfG+
la9uSt7HnnNULi6SdHFWwr5xibxYS3McMed3mI/6jGFpTldVlTL5/F7ZZlVU12ta
CmBod/bpfYcjSxeJl5458nyGD1kyW6DHIdrZjGlU3NZIpZzTgy+IEB6bvAZuTGW1
g91oPvGtJ9SDPQ+/dAfSqYtqT9A/DnT2EyNhUTTh2RKKW8RxqFs=
=CF6D
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-ruby-extras-maintainers/attachments/20261011/2823c338/attachment.sig>