Summary
It was discovered that Rack did not properly structure regular expressions
in some of its parsing components, which could result in uncontrolled
resource consumption if an application using Rack received specially
crafted input. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-44570, CVE-2022-44571)
It was discovered that Rack did not properly structure regular expressions
in its multipart parsing component, which could result in uncontrolled
resource consumption if an application using Rack to parse multipart posts
received specially crafted input. A remote attacker could possibly use
this issue to cause a denial of service. This issue was only fixed in
Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2022-44572)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm3 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1+esm3 |
Vulnerabilities 3
-
High 7.5
Denial of service via header parsing in Rack
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vec…
-
Low —
Denial of Service Vulnerability in Rack Content-Disposition parsing
There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unex…
-
Low —
Denial of service via multipart parsing in Rack
A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, p…