chore(deps): update dependency sinatra to v4 [security]#2430
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update dependency sinatra to v4 [security]#2430renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
renovate
bot
changed the title
SoeAung95
reviewed
Mar 1, 2025
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
589b7d5 to
d1653dd
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
d1653dd to
60c20bb
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
60c20bb to
ccb20f4
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
ccb20f4 to
5fca6fb
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
5fca6fb to
9bb5f6a
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
9bb5f6a to
fdc21fa
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
fdc21fa to
f6b7e02
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
f6b7e02 to
8da56f9
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
2 times, most recently
from
39f8b2d to
1ce4b36
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
2 times, most recently
from
04e4431 to
4697f8e
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
4697f8e to
ec2837f
Compare
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
ec2837f to
00fa412
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.2.0→4.2.0GitHub Vulnerability Alerts
CVE-2024-21510
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
CVE-2025-61921
Summary
There is a denial of service vulnerability in the
If-MatchandIf-None-Matchheader parsing component of Sinatra, if theetagmethod is used when constructing the response and you are using Ruby < 3.2.Details
Carefully crafted input can cause
If-MatchandIf-None-Matchheader parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating theETagheader value. Any applications that use theetagmethod when generating a response are impacted if they are using Ruby below version 3.2.Resources
Release Notes
sinatra/sinatra (sinatra)
v4.2.0Compare Source
:static_headerssetting for custom headers in static file responses (#2089)etag_matches?to prevent ReDoS (#2121)PATH_INFOcan never be empty (#2114)content_typeparameters (#2078)v4.1.1Compare Source
v4.1.0Compare Source
host_authorizationsetting (#2053).localhost,.testand any IP address in development mode.Sinatra::IndifferentHashwhen calling#except(#2044)URIfor Ruby 3.4 (#2060)rackupno longer depends on WEBrick, recommend Puma instead (4a558503)--enable-frozen-string-literal(#2033)Rack::Loggercontent-lengthheader whenRack::Filesis usedv4.0.1Compare Source
Rack 3.1 compatibility (#2035)
Fix malformed Content-Type headers (#2081)
Avoid crash for integer values in
content_typeparameters (#2078)Fix compatibility with --enable-frozen-string-literal (#2033)
Declare missing dependencies for Ruby 3.5 (#2032)
Fix warning about Hash construction. (#2028)
Support Zeitwerk 2.7.0+ (#2050)
Address URI depreciation (#2060)
v4.0.0Compare Source
New: Add support for Rack 3 (#1857)
Require Ruby 2.7.8 as minimum Ruby version (#1993)
Breaking change: Drop support for Rack 2 (#1857)
rackupgem installedBreaking change: Remove the
IndifferentHashinitializer (#1982)Breaking change: Disable
session_hijackingprotection by default (#1984)Breaking change: Remove
Rack::Protection::EncryptedCookie(#1989)Rack::Session::Cookie)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.