Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcs | May 31, 2024 | Feb 29, 2024 |
| Amazon Linux Ami 2 | — | Upgrade pcs-debuginfoUpgrade pcsUpgrade pcs-snmp | Mar 19, 2024 | Feb 29, 2024 |
| Debian | — | Upgrade ruby-rack | Apr 30, 2024 | Feb 29, 2024 |
| Oracle_linux | — | Upgrade pcsUpgrade pcs-snmp | May 7, 2024 | Feb 22, 2024 |
| Redhat_linux | — | No solution existsUpgrade pcs-snmpUpgrade pcs | Apr 17, 2024 | Feb 29, 2024 |
| Rocky_linux | — | Upgrade pcsUpgrade pcs-snmp | Jun 17, 2024 | Feb 29, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rackUpgrade ruby2.5-rubygem-rack-docUpgrade ruby2.1-rubygem-rack-1_4Upgrade ruby2.5-rubygem-rack-testsuite | Mar 6, 2024 | Feb 29, 2024 |
| Ubuntu | — | Upgrade ruby-rack (Ubuntu Pro)Upgrade ruby-rack | Jun 21, 2024 | Feb 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub