Name: CVE-2022-23837: Allocation of Resources Without Limits or Throttling
Creator: Rapid7
Published: 2022-01-21T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2022-23837, CWE-770, CVSS 7.5, EPSS 0.006

In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-loggingUpgrade rubygem-highlineUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-http-cookieUpgrade rubygem-localeUpgrade rubygem-oauthUpgrade rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-unf_extUpgrade rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-debugsourceUpgrade tfm-runtimeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-domain_nameUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-unicode-display_widthUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-powerbarUpgrade rubygem-clampUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-http-cookieUpgrade satellite-maintainUpgrade rubygem-little-pluggerUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-jwtUpgrade rubygem-mime-typesUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-netrc	Jul 14, 2022	Jan 21, 2022
Debian	—	Upgrade ruby-sidekiq	Mar 14, 2022	Jan 21, 2022
Redhat_linux	—	Upgrade rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-domain_nameUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-loggingUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-amazing_printUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-localeUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-amazing_printUpgrade tfm-rubygem-loggingUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-unicode-debugsourceUpgrade rubygem-highlineUpgrade rubygem-apipie-bindingsUpgrade tfm-runtimeUpgrade rubygem-netrcUpgrade rubygem-unicodeUpgrade tfm-rubygem-clampUpgrade rubygem-hashieUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-netrcUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-http-cookieUpgrade satellite-cliUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade foreman-cliUpgrade tfm-rubygem-domain_nameUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman	Jul 14, 2022	Jan 21, 2022
Rocky_linux	—	Upgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfo	Mar 12, 2024	Jan 21, 2022
Ubuntu	—	Upgrade ruby-sidekiq (Ubuntu Pro)	Jul 1, 2025	Jan 21, 2022

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business