A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-oauth-ttyUpgrade rubygem-http-acceptUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-localeUpgrade rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade satellite-cloneUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_katelloUpgrade satellite-maintainUpgrade rubygem-domain_nameUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-http-cookieUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unfUpgrade rubygem-hammer_cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_templatesUpgrade foreman-cliUpgrade python39-pulp_manifestUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-gssapiUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_admin | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade ruby-rack | Feb 1, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade rubygem-rack22Upgrade rubygem-rack16Upgrade rubygem-rack | Jan 20, 2023 | Jan 19, 2023 |
| Redhat_linux | — | Upgrade rubygem-unicodeUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade rubygem-version_gemUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-http-acceptUpgrade rubygem-unf_extUpgrade rubygem-unicode-debugsourceUpgrade rubygem-gssapiUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-ffi-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-oauthUpgrade rubygem-snaky_hashUpgrade rubygem-multi_jsonUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cliUpgrade rubygem-netrcUpgrade rubygem-mime-typesUpgrade foreman-cliUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-clampUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffiUpgrade rubygem-oauth-ttyUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-powerbarUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-rackUpgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rack-doc | Feb 7, 2023 | Feb 7, 2023 |
| Ubuntu | — | Upgrade ruby-rackUpgrade ruby-rack (Ubuntu Pro) | Mar 22, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub