HIGH
rubygem-rack: denial of service in Content-Disposition parsing
Published Feb 9, 2023
7.5
HIGHCVSS 3.1
EPSS 1.62%
Description
A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Affected products
No data.
No data.
Red Hat Satellite 6.14 for RHEL 8
rubygem-rack-0:2.2.7-1.el8sat
Fixed · RHSA-2023:6818
Red Hat Satellite 6.14 for RHEL 8
rubygem-rack-0:2.2.7-1.el8sat
Fixed · RHSA-2023:6818
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Satellite 6.14 for RHEL 8 | rubygem-rack-0:2.2.7-1.el8sat | Fixed | RHSA-2023:6818 |
| Red Hat Satellite 6.14 for RHEL 8 | rubygem-rack-0:2.2.7-1.el8sat | Fixed | RHSA-2023:6818 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (10)
- https://access.redhat.com/security/cve/CVE-2022-44572 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2164722 Issue Tracking
- https://github.com/advisories/GHSA-rqv2-275x-2jq5 Advisory
- https://github.com/rack/rack/releases/tag/v3.0.4.1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-44572.yml
- https://hackerone.com/reports/1639882 Permissions RequiredThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-44572
- https://security.netapp.com/advisory/ntap-20231208-0014/
- https://www.cve.org/CVERecord?id=CVE-2022-44572
- https://www.debian.org/security/2023/dsa-5530 vendor-advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner hackerone
Published Feb 9, 2023
Updated Aug 3, 2024
Reserved Nov 1, 2022
Link CVE-2022-44572
CISA Vulnrichment
GHSA-RQV2-275X-2JQ5 Updated n/a