A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-rest-clientUpgrade rubygem-http-cookieUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cloneUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unfUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-oauth-ttyUpgrade rubygem-highlineUpgrade rubygem-version_gemUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-oauthUpgrade rubygem-hashieUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-netrcUpgrade rubygem-loggingUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-unf_ext | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade ruby-rack | Feb 1, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade rubygem-rack16Upgrade rubygem-rackUpgrade rubygem-rack22 | Jan 20, 2023 | Jan 19, 2023 |
| Redhat_linux | — | Upgrade rubygem-foreman_maintainUpgrade rubygem-loggingUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-version_gemUpgrade rubygem-http-acceptUpgrade python39-pulp_manifestUpgrade satellite-maintainUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffi-debuginfoUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-highlineUpgrade rubygem-localeUpgrade rubygem-hashieUpgrade rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade rubygem-oauth-ttyUpgrade satellite-cloneUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unfUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cliUpgrade satellite-cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-gssapiUpgrade rubygem-unicode-display_widthUpgrade rubygem-domain_nameUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicodeUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauthUpgrade rubygem-ffiUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_katello | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-debugsource | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rackUpgrade ruby2.5-rubygem-rack-doc | Feb 7, 2023 | Feb 7, 2023 |
| Ubuntu | — | Upgrade ruby-rack (Ubuntu Pro)Upgrade ruby-rack | Mar 22, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub