A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-oauthUpgrade rubygem-mime-types-dataUpgrade python39-pulp_manifestUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cliUpgrade rubygem-rest-clientUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-gssapiUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-clampUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade rubygem-http-cookieUpgrade rubygem-amazing_printUpgrade rubygem-hashieUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-powerbarUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade rubygem-multi_jsonUpgrade satellite-cloneUpgrade satellite-maintainUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-http-acceptUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debugsourceUpgrade rubygem-netrcUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-fast_gettextUpgrade rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-little-plugger | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade ruby-rack | Feb 1, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade rubygem-rack22Upgrade rubygem-rack16Upgrade rubygem-rack | Jan 20, 2023 | Jan 19, 2023 |
| Redhat_linux | — | Upgrade rubygem-fast_gettextUpgrade rubygem-unicodeUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cliUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-version_gemUpgrade rubygem-multi_jsonUpgrade rubygem-gssapiUpgrade rubygem-snaky_hashUpgrade rubygem-oauthUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-http-cookieUpgrade python39-pulp_manifestUpgrade rubygem-jwtUpgrade rubygem-domain_nameUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-types-dataUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-display_widthUpgrade rubygem-hashieUpgrade rubygem-clampUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_templatesUpgrade foreman-cliUpgrade rubygem-netrcUpgrade satellite-cloneUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unfUpgrade rubygem-mime-types | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-rackUpgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rack-doc | Feb 7, 2023 | Feb 7, 2023 |
| Ubuntu | — | Upgrade ruby-rackUpgrade ruby-rack (Ubuntu Pro) | Mar 22, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub