[USN-7366-2] Rack vulnerabilities
[USN-7657-2] jq vulnerabilities
[USN-7366-2] Rack vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7366-2
July 23, 2025
ruby-rack vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 25.04
Summary:
Several security issues were fixed in Rack.
Software Description:
- ruby-rack: modular Ruby webserver interface
Details:
USN-7366-1 fixed vulnerabilities in Rack. This update provides the
corresponding updates for Ubuntu 25.04.
Original advisory details:
Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)
Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)
Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 25.04
ruby-rack 2.2.7-1.1ubuntu0.25.04.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7366-2
https://ubuntu.com/security/notices/USN-7366-2
CVE-2025-25184, CVE-2025-27111, CVE-2025-27610
Package Information:
https://launchpad.net/ubuntu/+source/ruby-rack/2.2.7-1.1ubuntu0.25.04.2
[USN-7657-2] jq vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7657-2
July 22, 2025
jq vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in jq.
Software Description:
- jq: lightweight and flexible command-line JSON processor
Details:
USN-7657-1 fixed CVE-2024-23337 and CVE-2025-48060 in jq. This update
provides the corresponding fixes for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS,
and Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that jq incorrectly handled certain values when parsing
JSON data. A remote attacker could possibly use this issue to cause jq to
crash, resulting in a denial of service. (CVE-2024-23337)
It was discovered that jq incorrectly handled certain values when parsing
JSON data. A remote attacker could use this issue to cause jq to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2025-48060)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
jq 1.6-1ubuntu0.20.04.1+esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
jq 1.5+dfsg-2ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
jq 1.5+dfsg-1ubuntu0.1+esm3
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7657-2
https://ubuntu.com/security/notices/USN-7657-2
CVE-2024-23337, CVE-2025-48060
