A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade satellite-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauth-ttyUpgrade rubygem-localeUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicodeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-mime-typesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-snaky_hashUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debugsourceUpgrade rubygem-jwtUpgrade rubygem-little-pluggerUpgrade rubygem-domain_nameUpgrade satellite-maintainUpgrade rubygem-clampUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-http-cookieUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade rubygem-unfUpgrade rubygem-hammer_cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unf_extUpgrade rubygem-amazing_printUpgrade python39-pulp_manifestUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-gssapiUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-version_gem | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade ruby-rack | Feb 1, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade rubygem-rack16Upgrade rubygem-rackUpgrade rubygem-rack22 | Jan 20, 2023 | Jan 19, 2023 |
| Redhat_linux | — | Upgrade rubygem-hashieUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade satellite-cliUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-netrcUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-clampUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauthUpgrade python39-pulp_manifestUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-localeUpgrade rubygem-little-pluggerUpgrade rubygem-ffi-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-gssapiUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicodeUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-fast_gettextUpgrade rubygem-jwt | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-rackUpgrade ruby2.5-rubygem-rack-docUpgrade ruby2.5-rubygem-rack-testsuite | Feb 7, 2023 | Feb 7, 2023 |
| Ubuntu | — | Upgrade ruby-rackUpgrade ruby-rack (Ubuntu Pro) | Mar 22, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub