CVE-2022-44570 - rubygem-rack: denial of service in Content-Disposition parsing

Back Back to CVE browser

HIGH

rubygem-rack: denial of service in Content-Disposition parsing

Published Feb 9, 2023

7.5

HIGH

CVSS 3.1

EPSS 1.63%

Description

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Affected products

Red Hat Satellite 6.14 for RHEL 8

rubygem-rack-0:2.2.7-1.el8sat

Fixed · RHSA-2023:6818
Red Hat Satellite 6.14 for RHEL 8

rubygem-rack-0:2.2.7-1.el8sat

Fixed · RHSA-2023:6818

Product	Package	State	Advisory
Red Hat Satellite 6.14 for RHEL 8	rubygem-rack-0:2.2.7-1.el8sat	Fixed	RHSA-2023:6818
Red Hat Satellite 6.14 for RHEL 8	rubygem-rack-0:2.2.7-1.el8sat	Fixed	RHSA-2023:6818

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1333

CWE-400

Uncontrolled Resource Consumption

References (11)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-44570		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2164719		Issue Tracking
https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125		PatchVendor Advisory
https://github.com/advisories/GHSA-65f5-mfpf-vfhj		Advisory
https://github.com/rack/rack/releases/tag/v3.0.4.1
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-44570.yml
https://github.com/rubysec/ruby-advisory-db/tree/master/gems/rack/CVE-2022-44570.yml
https://nvd.nist.gov/vuln/detail/CVE-2022-44570
https://security.netapp.com/advisory/ntap-20231208-0010
https://www.cve.org/CVERecord?id=CVE-2022-44570
https://www.debian.org/security/2023/dsa-5530		vendor-advisory