Sinatra Vulnerability — Ubuntu Security Update (USN-8624-1)
It was discovered that Sinatra did not properly handle header parsing, causing ETag generation to hang when given specific input. A remote attacker could possibly use this issue to cause a denial of service.
Packages
- ruby-sinatra – Ruby web-development dressed in a DSL
Details
It was discovered that Sinatra did not properly handle header parsing,
causing ETag generation to hang when given specific input. A remote
attacker could possibly use this issue to cause a denial of service.
It was discovered that Sinatra did not properly handle header parsing,
causing ETag generation to hang when given specific input. A remote
attacker could possibly use this issue to cause a denial of service.
Update instructions
After a standard system update you need to restart any applications that
use ruby-sinatra to make all the necessary changes.
The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
|
22.04
LTS jammy |
ruby-sinatra –
2.0.8.1-2+deb11u1ubuntu0.1~esm1 |
||
|
20.04
LTS focal |
ruby-sinatra –
2.0.8.1-1ubuntu0.1~esm3 |
||
|
18.04
LTS bionic |
ruby-sinatra –
1.4.8-1ubuntu0.1~esm3 |
||
|
16.04
LTS xenial |
ruby-sinatra –
1.4.7-3ubuntu0.1~esm3 |
||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
How to Apply the Fix
Update the affected packages on your server to the patched release, then restart the relevant services.
sudo apt update && sudo apt upgradeCheck your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System