A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade foreman-cliUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-unfUpgrade rubygem-amazing_printUpgrade rubygem-clampUpgrade rubygem-mime-types-dataUpgrade python39-pulp_manifestUpgrade rubygem-oauthUpgrade rubygem-hashieUpgrade rubygem-powerbarUpgrade rubygem-rest-clientUpgrade rubygem-unf_extUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-gssapiUpgrade rubygem-foreman_maintainUpgrade rubygem-http-cookieUpgrade rubygem-snaky_hashUpgrade rubygem-ffiUpgrade rubygem-ffi-debugsourceUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cliUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-typesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-fast_gettextUpgrade rubygem-netrcUpgrade satellite-cloneUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-domain_nameUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade ruby-rack | Feb 1, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade rubygem-rack22Upgrade rubygem-rackUpgrade rubygem-rack16 | Jan 20, 2023 | Jan 19, 2023 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-gssapiUpgrade rubygem-unf_extUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-version_gemUpgrade rubygem-http-acceptUpgrade rubygem-loggingUpgrade rubygem-unicode-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-snaky_hashUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade python39-pulp_manifestUpgrade rubygem-oauthUpgrade rubygem-ffi-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-http-cookieUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffi-debuginfoUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-mime-typesUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-clampUpgrade satellite-cloneUpgrade rubygem-ffiUpgrade rubygem-powerbarUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_tasks | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-rack-docUpgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rack | Feb 7, 2023 | Feb 7, 2023 |
| Ubuntu | — | Upgrade ruby-rack (Ubuntu Pro)Upgrade ruby-rack | Mar 22, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub