A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcs | May 15, 2023 | Mar 10, 2023 |
| Centos_linux | — | Upgrade rubygem-ffi-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-powerbarUpgrade rubygem-unicode-debugsourceUpgrade rubygem-ffiUpgrade python39-pulp_manifestUpgrade rubygem-fast_gettextUpgrade rubygem-unicode-debuginfoUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-multi_jsonUpgrade satellite-cliUpgrade satellite-maintainUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_extUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_templatesUpgrade pcs-snmpUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-gssapiUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_adminUpgrade foreman-cliUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cliUpgrade rubygem-amazing_printUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-little-pluggerUpgrade rubygem-domain_nameUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade pcsUpgrade rubygem-highlineUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-clampUpgrade rubygem-unfUpgrade satellite-cloneUpgrade rubygem-hashieUpgrade rubygem-unicodeUpgrade rubygem-mime-types-data | May 15, 2023 | Mar 10, 2023 |
| Debian | — | Upgrade ruby-rack | Apr 20, 2023 | Mar 10, 2023 |
| Freebsd | — | Upgrade rubygem-rack16Upgrade rubygem-rackUpgrade rubygem-rack22 | Mar 7, 2023 | Mar 6, 2023 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade pcs | May 30, 2023 | Mar 8, 2023 |
| Redhat_linux | — | Upgrade pcs-snmpUpgrade pcsNo solution exists | Apr 26, 2023 | Mar 10, 2023 |
| Rocky_linux | — | Upgrade pcs-snmpUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade pcsUpgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | Mar 10, 2023 |
| Suse | — | Upgrade rmt-server-pubcloudUpgrade rmt-serverUpgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rack-docUpgrade rmt-server-configUpgrade ruby2.5-rubygem-rack | Mar 15, 2023 | Mar 10, 2023 |
| Ubuntu | — | Upgrade ruby-rack (Ubuntu Pro)Upgrade ruby-rack | Jun 21, 2024 | Mar 10, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub