A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-multi_jsonUpgrade satellite-maintainUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-jwtUpgrade rubygem-netrcUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-oauth-ttyUpgrade satellite-cliUpgrade satellite-cloneUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-typesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-display_widthUpgrade rubygem-gssapiUpgrade rubygem-mime-types-dataUpgrade python39-pulp_manifestUpgrade rubygem-foreman_maintainUpgrade rubygem-amazing_printUpgrade rubygem-unf_extUpgrade rubygem-highlineUpgrade rubygem-rest-clientUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade foreman-cliUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-version_gem | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade ruby-rack | Feb 1, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade rubygem-rack22Upgrade rubygem-rack16Upgrade rubygem-rack | Jan 20, 2023 | Jan 19, 2023 |
| Redhat_linux | — | Upgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-cloneUpgrade rubygem-highlineUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade rubygem-powerbarUpgrade rubygem-clampUpgrade rubygem-apipie-bindingsUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffiUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-unicodeUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-amazing_printUpgrade rubygem-http-cookieUpgrade rubygem-jwtUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-localeUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-domain_nameUpgrade rubygem-ffi-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-snaky_hashUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifestUpgrade rubygem-fast_gettextUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffi-debugsourceUpgrade rubygem-gssapiUpgrade rubygem-unicode-debugsourceUpgrade rubygem-http-accept | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-rack-docUpgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rack | Feb 7, 2023 | Feb 7, 2023 |
| Ubuntu | — | Upgrade ruby-rackUpgrade ruby-rack (Ubuntu Pro) | Mar 22, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub