Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcsUpgrade pcs-snmp | May 31, 2024 | Feb 29, 2024 |
| Amazon Linux Ami 2 | — | Upgrade pcs-debuginfoUpgrade pcs-snmpUpgrade pcs | Mar 19, 2024 | Feb 29, 2024 |
| Debian | — | Upgrade ruby-rack | Apr 30, 2024 | Feb 29, 2024 |
| Oracle_linux | — | Upgrade pcsUpgrade pcs-snmp | May 7, 2024 | Feb 22, 2024 |
| Redhat_linux | — | Upgrade pcsNo solution existsUpgrade pcs-snmp | Apr 17, 2024 | Feb 29, 2024 |
| Rocky_linux | — | Upgrade pcsUpgrade pcs-snmp | Jun 17, 2024 | Feb 29, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rack-docUpgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.1-rubygem-rack-1_4Upgrade ruby2.5-rubygem-rack | Mar 6, 2024 | Feb 29, 2024 |
| Ubuntu | — | Upgrade ruby-rack (Ubuntu Pro)Upgrade ruby-rack | Mar 13, 2024 | Feb 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub