Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-pcsalma-upgrade-pcs-snmp | May 31, 2024 | Feb 29, 2024 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-pcsamazon-linux-ami-2-upgrade-pcs-debuginfoamazon-linux-ami-2-upgrade-pcs-snmp | Mar 19, 2024 | Feb 29, 2024 | |
| Debian | debian-upgrade-ruby-rack | Apr 30, 2024 | Feb 29, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-pcsoracle-linux-upgrade-pcs-snmp | May 7, 2024 | Feb 22, 2024 |
| Redhat_linux | redhat-upgrade-pcsredhat-upgrade-pcs-snmp | Apr 17, 2024 | Feb 29, 2024 | |
| Rocky_linux | rocky-upgrade-pcsrocky-upgrade-pcs-snmp | Jun 17, 2024 | Feb 29, 2024 | |
| Suse | — | suse-upgrade-ruby2-1-rubygem-rack-1_4suse-upgrade-ruby2-5-rubygem-racksuse-upgrade-ruby2-5-rubygem-rack-docsuse-upgrade-ruby2-5-rubygem-rack-testsuite | Mar 6, 2024 | Feb 29, 2024 |
| Ubuntu | ubuntu-pro-upgrade-ruby-rackubuntu-upgrade-ruby-rack | Mar 13, 2024 | Feb 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub