ruby-rack (2.1.4-5ubuntu1.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service through large query parameters.
    - debian/patches/CVE-2025-46727.patch: Add query parameter limit and
      bytesize limit and corresponding checks in ./lib/rack/query_parser.rb.
    - CVE-2025-46727

  * SECURITY UPDATE: Limited Denial of service
    - debian/patches/CVE-2025-59830.patch: Fix unbounded parameter parsing
      in `Rack::QueryParser` by counting both possible parameter separators
      (& and ;)
    - CVE-2025-59830

  * SECURITY UPDATE: Denial of service
    - d/p/CVE-2025-61770-and-CVE-2025-61772.patch: Enforce a size limit for
      the preamble and multipart mime part header 
    - d/p/CVE-2025-61771.patch: Limit amount of retained data when parsing
      multipart requests
    - CVE-2025-61770
    - CVE-2025-61772
    - CVE-2025-61771

  * SECURITY UPDATE: Information discloure using proxy bypass
    - debian/patches/CVE-2025-61780.patch: Fix handling of proxy headers
      (`HTTP_X_SENDFILE_TYPE` and `HTTP_X_ACCEL_MAPPING`) in Rack::Sendfile
    - CVE-2025-61780 

  * SECURITY UPDATE: Denial of service through memory exhaustion
    - debian/patches/CVE-2025-61919.patch: Enforce form parameter limit
      using `query_parser.bytesize_limit` preventing unbounded read of 
      `application/x-www-form-urlencoded` bodies
    - CVE-2025-61919

 -- Shishir Subedi <shishir.subedi@canonical.com>  Mon, 01 Dec 2025 12:58:36 +0545

ruby-rack (2.1.4-5ubuntu1.1) jammy-security; urgency=high

  * SECURITY UPDATE: Outstanding CVEs patched upstream (LP: #2078711)
    - Following patches ported from debian bullseye (2.1.4-3+deb11u2)
    - CVE-2024-25126: ReDoS in Content Type header parsing
    - CVE-2024-26141: Reject Range headers which are too large
    - CVE-2024-26146: ReDoS in Accept header parsing
    - CVE-2022-30122: Add patch to restrict broken mime parsing.
    - CVE-2022-30123: Add patch to escape untrusted text when logging.
    - CVE-2022-44570: Add patch to fix ReDoS in Rack::Utils.get_byte_ranges.
    - CVE-2022-44571: Add patch to fix ReDoS vulnerability in multipart parser.
    - CVE-2022-44572: Add patch to forbid control characters in attributes.
    - CVE-2023-27530: Add patch to limit all multipart parts, not just files.
    - CVE-2023-27539: Add patch to avoid ReDoS problem.
  * Build test fix [ Bruce Cable <bruce.cable@canonical.com> ]
    - fix-spec-mock-tests.patch: modifies expected value for build tests to
      pass

 -- Lissa Moriarty <lissa.moriarty@york.ac.uk>  Mon, 02 Sep 2024 15:46:12 +0100

ruby-rack (2.1.4-5ubuntu1) jammy; urgency=medium

  * Add ruby-webrick as an explicit dependency.
    - it's not embedded as of ruby3.0. (:

 -- Utkarsh Gupta <utkarsh@debian.org>  Mon, 24 Jan 2022 18:59:02 +0530

ruby-rack (2.1.4-5) unstable; urgency=medium

  * Team upload
  * Switch to gem-install layout for bundle --local compatibility

 -- Pirate Praveen <praveen@debian.org>  Mon, 24 Jan 2022 00:48:23 +0530

ruby-rack (2.1.4-4) unstable; urgency=medium

  * Team upload

  [ Debian Janitor ]
  * Remove constraints unnecessary since buster

  [ Cédric Boutillier ]
  * Build-depend on ruby-webrick (Closes: #996353)
  * Bump debhelper compatibility level to 13
  * Bump Standards-Version to 4.6.0 (no changes needed)

 -- Cédric Boutillier <boutil@debian.org>  Wed, 17 Nov 2021 11:49:13 +0100

ruby-rack (2.1.4-3) unstable; urgency=medium

  * Team upload.
  * Fix tests when run on ipv6-only hosts (Closes: #979432)

 -- Antonio Terceiro <terceiro@debian.org>  Sat, 27 Feb 2021 09:30:57 -0300

ruby-rack (2.1.4-2) unstable; urgency=medium

  * Revert "Drop all patches"
    - Rack::Builder::parse_file#test_0006_strips
      leading unicode byte order mark when present still
      fails in i386 and stuff. Meh, I'll take a look later.

 -- Utkarsh Gupta <utkarsh@debian.org>  Sun, 03 Jan 2021 17:49:29 +0530

ruby-rack (2.1.4-1) unstable; urgency=medium

  [ Pirate Praveen ]
  * New upstream version 2.1.4
  * Bump Standards-Version to 4.5.1 (no changes needed)
  * Drop patches applied upstream

  [ Utkarsh Gupta ]
  * Drop all patches

 -- Utkarsh Gupta <utkarsh@debian.org>  Sun, 03 Jan 2021 17:25:43 +0530

ruby-rack (2.1.1-6) unstable; urgency=medium

  [ Cédric Boutillier ]
  * [ci skip] Update team name
  * [ci skip] Add .gitattributes to keep unwanted files out
    of the source package

  [ Debian Janitor ]
  * Apply multi-arch hints. + ruby-rack: Add :all qualifier
    for ruby dependency.

  [ Utkarsh Gupta ]
  * When parsing cookies, only decode the values.
    Patch utils to fix cookie parsing. (Fixes: CVE-2020-8184)
    (Closes: #963477)

 -- Utkarsh Gupta <utkarsh@debian.org>  Sat, 02 Jan 2021 17:42:02 +0530

ruby-rack (2.1.1-5) unstable; urgency=medium

  * Add patch to use Dir.entries instead of Dir[glob] to prevent
    user-specified glob metacharacters (Fixes: CVE-2020-8161)

 -- Utkarsh Gupta <utkarsh@debian.org>  Thu, 21 May 2020 17:06:27 +0530

# For older changelog entries, run 'apt-get changelog ruby-rack'
