A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade foreman-cliUpgrade rubygem-clampUpgrade rubygem-version_gemUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unfUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade python39-pulp_manifestUpgrade rubygem-foreman_maintainUpgrade rubygem-mime-types-dataUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debuginfoUpgrade rubygem-netrcUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-http-acceptUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-jwtUpgrade rubygem-domain_nameUpgrade satellite-maintainUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-little-pluggerUpgrade rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foremanUpgrade satellite-cliUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffiUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade ruby-rack | Feb 1, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade rubygem-rackUpgrade rubygem-rack22Upgrade rubygem-rack16 | Jan 20, 2023 | Jan 19, 2023 |
| Redhat_linux | — | Upgrade python39-pulp_manifestUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-gssapiUpgrade rubygem-multi_jsonUpgrade rubygem-localeUpgrade rubygem-little-pluggerUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-http-cookieUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-snaky_hashUpgrade rubygem-amazing_printUpgrade rubygem-unicodeUpgrade rubygem-rest-clientUpgrade rubygem-loggingUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffi-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unf_ext-debugsourceUpgrade foreman-cliUpgrade satellite-cliUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hashieUpgrade rubygem-unf_ext-debuginfoUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-apipie-bindingsUpgrade rubygem-netrcUpgrade rubygem-ffiUpgrade rubygem-clampUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unfUpgrade rubygem-powerbarUpgrade satellite-maintainUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_openscap | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-rackUpgrade ruby2.5-rubygem-rack-docUpgrade ruby2.5-rubygem-rack-testsuite | Feb 7, 2023 | Feb 7, 2023 |
| Ubuntu | — | Upgrade ruby-rack (Ubuntu Pro)Upgrade ruby-rack | Mar 22, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub