Sinatra has ReDoS vulnerability in ETag header value generation
Résumé
Sinatra has ReDoS vulnerability in ETag header value generation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted input can cause If-Match and If-None-Match header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the ETag header value. Any applications that use the etag method when generating a response are impacted. Version 4.2.0 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-61921 ruby-sinatra
- Ubuntu UBUNTU-CVE-2025-61921 ruby-sinatra Corrigé dans: 1.4.7-3ubuntu0.1~esm3
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- report github.com
- web bugs.ruby-lang.org