A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-version_gemUpgrade rubygem-amazing_printUpgrade foreman-cliUpgrade rubygem-clampUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-highlineUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-display_widthUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unfUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-oauthUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffi-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-domain_nameUpgrade rubygem-jwtUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade satellite-maintainUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-fast_gettextUpgrade rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debuginfoUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-http-accept | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade ruby-rack | Feb 1, 2023 | Feb 1, 2023 |
| Freebsd | — | Upgrade rubygem-rack16Upgrade rubygem-rackUpgrade rubygem-rack22 | Jan 20, 2023 | Jan 19, 2023 |
| Redhat_linux | — | Upgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hashieUpgrade rubygem-unicode-display_widthUpgrade rubygem-ffiUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-cliUpgrade rubygem-netrcUpgrade rubygem-clampUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-mime-types-dataUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifestUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debugsourceUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade rubygem-unicodeUpgrade rubygem-ffi-debuginfoUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-loggingUpgrade rubygem-gssapiUpgrade rubygem-http-cookieUpgrade rubygem-fast_gettextUpgrade rubygem-little-pluggerUpgrade rubygem-version_gemUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-oauthUpgrade rubygem-snaky_hashUpgrade rubygem-multi_json | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | rocky-upgrade-libdb-cxxrocky-upgrade-libdb-cxx-debuginforocky-upgrade-libdb-debuginforocky-upgrade-libdb-debugsourcerocky-upgrade-libdb-sql-debuginforocky-upgrade-libdb-sql-devel-debuginforocky-upgrade-libdb-utils-debuginfo | Mar 5, 2024 | Feb 9, 2023 | |
| Suse | — | suse-upgrade-ruby2-5-rubygem-racksuse-upgrade-ruby2-5-rubygem-rack-docsuse-upgrade-ruby2-5-rubygem-rack-testsuite | Feb 7, 2023 | Feb 7, 2023 |
| Ubuntu | ubuntu-pro-upgrade-ruby-rackubuntu-upgrade-ruby-rack | Mar 22, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub