CVE-2015-3225 — Rack vulnerable to Denial of Service via large parameter depth request

Description

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	ruby-rack	1.5.2-4	—
Debian 13	ruby-rack	1.5.2-4	—
Debian 12	ruby-rack	1.5.2-4	—
Debian 8	ruby-rack	1.5.2-3+deb8u1	DSA-3322-1
Debian 7	ruby-rack	1.4.1-2.1+deb7u1	DSA-3322-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Debian 6.0	librack-ruby	1.1.0-4+squeeze3	DLA-254-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	pcs	0.9.143-15.el7	RHSA-2015:2290

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Satellite Capsule 6	SOAPpy	0.11.6-17.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	createrepo_c +1	0.7.4-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	facter	1:2.4.6-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	gofer +2	2.7.7-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	hiera	1.3.1-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	kobo +1	0.5.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	libstemmer	0-2.585svn.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	libwebsockets	2.1.0-3.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	mod_passenger +3	4.0.18-23.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	mod_xsendfile	0.12-10.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	mongodb +1	2.6.11-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	ostree	2017.1-2.atomic.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	puppet +1	3.8.6-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	puppet-agent	1.10.9-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	puppet-agent-oauth	0.5.1-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	puppetlabs-stdlib	4.2.1-1.20140510git08b00d9.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	puppetserver	2.8.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-amqp	1.4.9-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-anyjson	0.3.3-5.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-billiard	1:3.3.0.20-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-blinker	1.3-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-bson +2	3.2-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-celery	3.1.17-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-crane	2.1.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-django +1	1.6.11-5.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-flask	1:0.10.1-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-fpconst	0.7.3-12.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-gnupg	0.3.7-1.el7ui	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-httplib2	0.6.0-6.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-isodate	0.5.0-5.pulp.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-itsdangerous	0.23-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-jinja2	2.7.2-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-kid	0.9.6-11.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-kombu	1:3.0.33-8.pulp.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-mongoengine	0.10.5-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-nectar	1.5.4-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-oauth2	1.5.211-8.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-okaara	1.0.32-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-qpid	1.35.0-5.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-semantic_version	2.2.0-6.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-simplejson	3.2.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-twisted-core	12.2.0-4.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-twisted-web	12.1.0-5.el7_2	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-werkzeug	0.9.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	python-zope-interface	4.0.5-4.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	qpid-cpp +6	1.36.0-9.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	qpid-dispatch +2	0.8.0-16.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	qpid-proton +2	0.16.0-7.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	redhat-access-insights-puppet	0.0.9-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	repoview	0.6.6-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	ruby-augeas	0.5.0-1.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	ruby-rgen	0.6.5-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	ruby-shadow	1.4.1-21.el7	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-ansi	1.4.3-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-bundler_ext	0.4.1-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-clamp	1.0.0-8.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-concurrent-ruby	1:1.0.3-2.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-fast_gettext	1.1.0-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-ffi	1.4.0-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-gssapi	1.1.2-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-hashie	2.0.5-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-highline	1.6.21-5.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-little-plugger	1.1.3-21.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-logging	1.8.2-7.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-mime-types	1.19-7.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-multi_json	1.10.1-3.git.1551.b3eae6f.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-netrc	0.7.7-9.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-newt	0.9.6-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-openscap	0.4.7-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-powerbar	1.0.17-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-rack	1:1.6.4-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-rack-protection	1.5.3-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-rake	0.9.2.2-41.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-rb-inotify	0.9.7-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-rest-client	1.6.7-7.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-rkerberos	0.1.3-2.2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-rubyipmi	0.10.0-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-sinatra	1:1.4.7-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	rubygem-tilt	1.3.7-2.git.0.3b416c9.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	saslwrapper +1	0.22-5.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm +1	3.2-11.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-algebrick	0.7.3-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-params	0.0.5-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-bundler_ext	0.4.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby	1:1.0.3-1.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby-edge	1:0.2.3-1.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-domain_name	0.5.20160310-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-dynflow	0.8.34-1.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-ffi	1.4.0-10.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-gssapi	1.2.0-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-http-cookie	1.0.2-3.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-net-scp	1.1.0-7.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh	4.0.1-2.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh-krb	0.4.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-netrc	0.7.7-8.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-rest-client	1.8.0-4.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-sequel	4.20.0-6.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-unf	0.1.3-5.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	tfm-rubygem-unf_ext	0.0.6-6.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	v8	1:3.14.5.10-19.el7sat	RHBA-2018:0337
Red Hat Satellite Capsule 6	yaml-cpp	0.5.1-7.el7sat	RHBA-2018:0337
Red Hat Satellite 6	SOAPpy	0.11.6-17.el7	RHBA-2018:0337
Red Hat Satellite 6	createrepo_c +1	0.7.4-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	facter	1:2.4.6-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	gofer +2	2.7.7-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	hiera	1.3.1-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	kobo +2	0.5.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	libstemmer	0-2.585svn.el7sat	RHBA-2018:0337
Red Hat Satellite 6	libwebsockets	2.1.0-3.el7	RHBA-2018:0337
Red Hat Satellite 6	liquibase	3.1.0-1.el7	RHBA-2018:0337
Red Hat Satellite 6	mod_passenger +6	4.0.18-23.el7sat	RHBA-2018:0337
Red Hat Satellite 6	mod_xsendfile	0.12-10.el7sat	RHBA-2018:0337
Red Hat Satellite 6	mongodb +1	2.6.11-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	ostree	2017.1-2.atomic.el7	RHBA-2018:0337
Red Hat Satellite 6	puppet +1	3.8.6-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	puppet-agent	1.10.9-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	puppet-agent-oauth	0.5.1-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	puppetlabs-stdlib	4.2.1-1.20140510git08b00d9.el7sat	RHBA-2018:0337
Red Hat Satellite 6	puppetserver	2.8.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-amqp	1.4.9-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-anyjson +1	0.3.3-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-billiard	1:3.3.0.20-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-blinker	1.3-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-bson +2	3.2-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-celery	3.1.17-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-crane	2.1.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-django +1	1.6.11-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-flask	1:0.10.1-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-fpconst	0.7.3-12.el7	RHBA-2018:0337
Red Hat Satellite 6	python-gnupg	0.3.7-1.el7ui	RHBA-2018:0337
Red Hat Satellite 6	python-httplib2	0.6.0-6.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-isodate	0.5.0-5.pulp.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-itsdangerous	0.23-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-jinja2	2.7.2-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-kid	0.9.6-11.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-kombu	1:3.0.33-8.pulp.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-mongoengine	0.10.5-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-nectar	1.5.4-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-oauth2	1.5.211-8.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-okaara	1.0.32-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-qpid	1.35.0-5.el7	RHBA-2018:0337
Red Hat Satellite 6	python-semantic_version	2.2.0-6.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-simplejson	3.2.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-twisted-core	12.2.0-4.el7	RHBA-2018:0337
Red Hat Satellite 6	python-twisted-web	12.1.0-5.el7_2	RHBA-2018:0337
Red Hat Satellite 6	python-werkzeug	0.9.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	python-zope-interface	4.0.5-4.el7	RHBA-2018:0337
Red Hat Satellite 6	qpid-cpp +7	1.36.0-9.el7	RHBA-2018:0337
Red Hat Satellite 6	qpid-dispatch +2	0.8.0-16.el7sat	RHBA-2018:0337
Red Hat Satellite 6	qpid-proton +2	0.16.0-7.el7	RHBA-2018:0337
Red Hat Satellite 6	redhat-access-insights-puppet	0.0.9-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	repoview	0.6.6-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	ruby-augeas	0.5.0-1.el7	RHBA-2018:0337
Red Hat Satellite 6	ruby-rgen	0.6.5-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	ruby-shadow	1.4.1-21.el7	RHBA-2018:0337
Red Hat Satellite 6	rubygem-ansi	1.4.3-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-bundler_ext	0.4.1-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-clamp +1	1.0.0-8.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-concurrent-ruby	1:1.0.3-2.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-ffi	1.4.0-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-gssapi	1.1.2-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-hashie +1	2.0.5-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-highline	1.6.21-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-little-plugger +1	1.1.3-21.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-logging	1.8.2-7.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-mime-types	1.19-7.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-multi_json	1.10.1-3.git.1551.b3eae6f.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-netrc	0.7.7-9.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-newt	0.9.6-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-openscap +1	0.4.7-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-powerbar +1	1.0.17-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-rack	1:1.6.4-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-rack-protection	1.5.3-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-rake	0.9.2.2-41.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-rb-inotify	0.9.7-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-rest-client	1.6.7-7.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-rkerberos	0.1.3-2.2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-rubyipmi	0.10.0-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-sinatra	1:1.4.7-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	rubygem-tilt	1.3.7-2.git.0.3b416c9.el7sat	RHBA-2018:0337
Red Hat Satellite 6	saslwrapper +1	0.22-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm +1	3.2-11.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-activerecord-session_store	0.1.2-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-addressable	2.3.6-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-algebrick	0.7.3-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-ancestry	2.2.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-anemone	0.7.2-14.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-angular-rails-templates	1:1.0.2-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-apipie-params	0.0.5-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-apipie-rails	0.5.6-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-audited	4.4.1-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-bundler_ext	0.4.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-concurrent-ruby	1:1.0.3-1.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-concurrent-ruby-edge	1:0.2.3-1.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-css_parser	1.4.7-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-daemons	1.2.3-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-deacon	1.0.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-deep_cloneable	2.2.2-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-deface +1	1.2.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-diffy	3.0.1-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-docker-api	1.28.0-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-domain_name	0.5.20160310-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-dynflow	0.8.34-1.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-excon	0.51.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-extlib	0.9.16-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-facter	2.4.0-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-faraday	0.9.1-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fast_gettext	1.4.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-ffi	1.4.0-10.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog	1.38.0-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog-core	1.42.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog-google	0.1.0-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog-json	1.0.2-6.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog-libvirt +1	0.2.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog-openstack	0.1.18-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog-vsphere +1	1.7.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog-xenserver	0.2.3-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-fog-xml	0.1.2-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-formatador	0.2.1-9.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-friendly_id	5.1.0-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-get_process_mem	0.2.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-gettext_i18n_rails	1.2.1-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-git	1.2.5-7.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-google-api-client	0.8.2-7.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-gssapi	1.2.0-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-highline	1.7.8-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-http-cookie	1.0.2-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-ipaddress	0.8.0-9.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-jgrep	1.3.3-8.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-jwt +1	1.2.0-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-launchy	2.4.3-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-locale	2.0.9-11.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-logging	1.8.2-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-net-ldap	0.15.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-net-ping	2.0.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-net-scp	1.1.0-7.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-net-ssh	4.0.1-2.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-net-ssh-krb	0.4.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-netrc	0.7.7-8.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-parse-cron	0.1.4-2.fm1_15.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-pg	0.15.1-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-qpid_messaging	1.36.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-rabl	0.12.0-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-rack-jsonp	1.3.1-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-rails-i18n	4.0.9-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-rainbow	2.2.1-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-rbovirt +1	0.1.4-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-rbvmomi	1.10.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-redhat_access_lib	1.1.4-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-responders	2.3.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-rest-client	1.8.0-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-retriable	1.4.1-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-roadie	3.2.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-roadie-rails	1.1.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-robotex	1.0.0-19.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-ruby-libvirt	0.5.2-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-ruby2ruby	2.1.3-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-ruby_parser	3.6.3-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-runcible	1.12.0.3-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-safemode	1.3.2-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-scoped_search	4.1.2-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-secure_headers	3.4.1-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-sequel	4.20.0-6.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-sexp_processor	4.4.4-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-signet	0.6.0-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-sshkey	1.9.0-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-trollop	2.1.2-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-unf	0.1.3-5.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-unf_ext	0.0.6-6.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-unicode-display_width	1.0.5-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-useragent	0.16.8-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-validates_lengths_from_database	0.5.0-3.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-webpack-rails	0.9.8-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-wicked +1	1.1.0-4.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-will_paginate	3.1.5-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	tfm-rubygem-x-editable-rails	1.5.5-1.el7sat	RHBA-2018:0337
Red Hat Satellite 6	v8	1:3.14.5.10-19.el7sat	RHBA-2018:0337
Red Hat Satellite 6	yaml-cpp	0.5.1-7.el7sat	RHBA-2018:0337

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12	rubygem-rack-1_4	1.4.5-8.10	SUSE-SU-2015:2190-1
SLES 11 SP4	rubygem-rack-1_4	1.4.5-0.7.3	SUSE-SU-2015:1522-1
SLES 11 SP3	rubygem-rack	1.1.6-0.11.2	SUSE-SU-2015:1888-1
SLES 11 SP3	rubygem-rack-1_4	1.4.5-0.7.3	SUSE-SU-2015:1522-1

Show 6 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SUSE WebYast 1.3	rubygem-rack-1_4	1.4.5-0.7.3	SUSE-SU-2015:1522-1
SUSE Studio Onsite 1.3	rubygem-rack-1_4	1.4.5-0.7.3	SUSE-SU-2015:1522-1
SUSE OpenStack Cloud 5	rubygem-rack	1.5.2-9.6	SUSE-SU-2015:2274-1
SUSE Lifecycle Management Server 1.3	rubygem-rack	1.1.6-0.11.2	SUSE-SU-2015:1888-1
SUSE Lifecycle Management Server 1.3	rubygem-rack-1_4	1.4.5-0.7.3	SUSE-SU-2015:1522-1
SUSE Enterprise Storage 2	rubygem-rack-1_4	1.4.5-8.10	SUSE-SU-2015:2190-1
SUSE Enterprise Storage 1.0	rubygem-rack-1_4	1.4.5-8.10	SUSE-SU-2015:2190-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	ruby3.2-rubygem-rack	3.0.7-1.2	openSUSE-SU-2024:13167-1
openSUSE Tumbleweed	ruby3.2-rubygem-rack-2.2	2.2.7-1.1	openSUSE-SU-2024:12974-1
openSUSE Tumbleweed	rubygem-rack	2.2.3.1-1.1	openSUSE-SU-2026:10358-1, openSUSE-SU-2025:14875-1, openSUSE-SU-2024:13726-1
openSUSE Tumbleweed	rubygem-rack-2.2	2.2.4-1.1	openSUSE-SU-2026:10286-1, openSUSE-SU-2025:14811-1, openSUSE-SU-2024:13727-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	rack	>= 1.5.0, < 1.5.4	1.5.4	GHSA-rgr4-9jh5-j4j6
RubyGems	rack	>= 1.6.0, < 1.6.2	1.6.2	GHSA-rgr4-9jh5-j4j6
RubyGems	rack	>= 1.4.0, < 1.4.6	1.4.6	GHSA-rgr4-9jh5-j4j6

Advisories 18

RHBA-2018:0337 Red Hat Bug Fix Advisory: Red Hat Satellite 6.3 Base Libraries Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2015:2290 Red Hat Security Advisory: pcs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
openSUSE-SU-2026:10358-1 ruby4.0-rubygem-rack-3.1.18-1.3 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
DSA-3322-1 ruby-rack - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-254-1 librack-ruby - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2015:2274-1 Security update for rubygem-rack SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:14811-1 ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13727-1 ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13167-1 ruby3.2-rubygem-rack-3.0.7-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12119-1 ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2015:1522-1 Security update for rubygem-rack-1_4 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13726-1 ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12397-1 ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2015:1888-1 Security update for rubygem-rack SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12974-1 ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2015:2190-1 Security update for rubygem-rack-1_4 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:14875-1 ruby3.4-rubygem-rack-3.1.12-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025

References

openSUSE-SU-2015:1262 vendor-advisory
openSUSE-SU-2015:1263 vendor-advisory
RHSA-2015:2290 vendor-advisory
FEDORA-2015-12979 vendor-advisory
https://github.com/rack/rack/blob/master/HISTORY.md
[rubyonrails-security] 20150616 [CVE-2015-3225] Potential Denial of Service Vulnerability in Rack mailing-list
DSA-3322 vendor-advisory
openSUSE-SU-2015:1259 vendor-advisory
75232 vdb-entry
FEDORA-2015-12978 vendor-advisory
[oss-security] 20150616 [CVE-2015-3225] Potential Denial of Service Vulnerability in Rack mailing-list