Re: Issues regarding ruby-rack/CVE-2019-16782
Utkarsh Gupta <email@example.com> writes:
> Please don't yet patch CVE-2019-16782 for Buster, Stretch, Jessie, et al.
> This security update induces a regression, resulting in some issues in
> using the library.
> Also, there's a slight possibility of this patch inducing a backdoor on
> it's own.
> The issues have already been opened to/with the upstream and I hope
> they're looking into it.
> P.S. Shall update here when available :)
Do you have any references to the upstream issue regarding the possible
Apparently the regression is unavoidable - see
Which in turn generated controversy - is it OK to cause breakage if it
fixes a known security issue?
This might rule out being able to provide fixes for Buster and Jessie.
Oh, I see, #1431 mentions the possible backdoor; a claim that was
It also seems like "I agree that the vulnerability is not that great and
does take substantial time to pull off." - wonder if it even worth
trying to fix this for anything other then unstable+testing.
Brian May <firstname.lastname@example.org>