A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcsUpgrade pcs-snmp | May 15, 2023 | Mar 10, 2023 |
| Centos_linux | — | Upgrade rubygem-amazing_printUpgrade rubygem-http-cookieUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-gssapiUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cloneUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicodeUpgrade pcsUpgrade foreman-cliUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauthUpgrade rubygem-domain_nameUpgrade rubygem-little-pluggerUpgrade rubygem-unicode-debuginfoUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-localeUpgrade rubygem-multi_jsonUpgrade rubygem-ffiUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffi-debugsourceUpgrade rubygem-loggingUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade pcs-snmpUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-netrcUpgrade satellite-maintainUpgrade satellite-cliUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-powerbar | May 15, 2023 | Mar 10, 2023 |
| Debian | — | Upgrade ruby-rack | Apr 20, 2023 | Mar 10, 2023 |
| Freebsd | — | Upgrade rubygem-rack16Upgrade rubygem-rackUpgrade rubygem-rack22 | Mar 7, 2023 | Mar 6, 2023 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade pcs | May 30, 2023 | Mar 8, 2023 |
| Redhat_linux | — | No solution existsUpgrade pcsUpgrade pcs-snmp | Apr 26, 2023 | Mar 10, 2023 |
| Rocky_linux | — | Upgrade pcs-snmpUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade pcs | Mar 5, 2024 | Mar 10, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-rackUpgrade rmt-server-configUpgrade rmt-server-pubcloudUpgrade ruby2.5-rubygem-rack-testsuiteUpgrade rmt-serverUpgrade ruby2.5-rubygem-rack-doc | Mar 15, 2023 | Mar 10, 2023 |
| Ubuntu | — | Upgrade ruby-rackUpgrade ruby-rack (Ubuntu Pro) | Jun 21, 2024 | Mar 10, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub