Skip to content
OpenAdvisories
Critical · 10.0 CVE-2022-30123 EUVD-2022-5620GHSA-wq4h-7r42-5hrr

Possible shell escape sequence injection vulnerability in Rack

Published Dec 5, 2022 · Updated Aug 3, 2024 · Assigned by hackerone

Package: rack Package: ruby-rack Package: ruby-rack Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

Affected products

VendorProductAffectedFixed
— https://github.com/rack/rack 2.0.9.1, 2.1.4.1, 2.2.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-rack 2.2.4-1 —
Debian 13 ruby-rack 2.2.4-1 —
Debian 12 ruby-rack 2.2.4-1 —
Debian 11 ruby-rack 2.1.4-3+deb11u1 DSA-5530-1
Debian 10 ruby-rack 2.0.6-3+deb10u1 DLA-3095-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS ruby-rack 2.1.4-5ubuntu1.1 USN-7036-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS ruby-rack 2.1.4-5ubuntu1+esm2 USN-5896-1
Ubuntu Pro 20.04 LTS ruby-rack 2.0.7-2ubuntu0.1+esm2 USN-5896-1, USN-5253-1
Ubuntu Pro 18.04 LTS ruby-rack 1.6.4-4ubuntu0.2+esm2 USN-5896-1, USN-5253-1
Ubuntu Pro 16.04 LTS ruby-rack 1.6.4-3ubuntu0.2+esm2 USN-5253-1
Ubuntu Pro 14.04 LTS ruby-rack 1.5.2-3+deb8u3ubuntu1~esm4 USN-5253-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 pcs +1 0.9.169-3.el7_9.3 RHSA-2022:7343
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Gluster Storage 3 grafana 5.2.4-6.el7rhgs RHSA-2023:1486
Red Hat Gluster Storage 3 rubygem-puma +1 4.3.12-1.el7rhgs RHSA-2023:1486
Red Hat Gluster Storage 3 rubygem-rack +1 2.2.4-1.el7rhgs RHSA-2023:1486
Red Hat Gluster Storage 3 rubygem-tzinfo +1 1.2.10-1.el7rhgs RHSA-2023:1486

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 rubygem-rack 2.0.8-150000.3.6.1 SUSE-SU-2022:2192-1
SLES 15 SP3 rubygem-rack 2.0.8-150000.3.6.1 SUSE-SU-2022:2192-1
SLES 15 SP2 rubygem-rack 2.0.8-150000.3.6.1 SUSE-SU-2022:2192-1
SLES 15 SP1 rubygem-rack 2.0.8-150000.3.6.1 SUSE-SU-2022:2192-1
SLES 15 rubygem-rack 2.0.8-150000.3.6.1 SUSE-SU-2022:2192-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 9 rubygem-rack 1.6.13-3.13.1 SUSE-SU-2022:2526-1
SUSE OpenStack Cloud Crowbar 8 rubygem-rack 1.6.13-3.13.1 SUSE-SU-2022:2526-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ruby3.2-rubygem-rack 3.0.7-1.2 openSUSE-SU-2024:13167-1
openSUSE Tumbleweed ruby3.2-rubygem-rack-2.2 2.2.7-1.1 openSUSE-SU-2024:12974-1
openSUSE Tumbleweed rubygem-rack 2.2.3.1-1.1 openSUSE-SU-2026:10358-1, openSUSE-SU-2025:14875-1, openSUSE-SU-2024:13726-1
openSUSE Tumbleweed rubygem-rack-2.2 2.2.4-1.1 openSUSE-SU-2026:10286-1, openSUSE-SU-2025:14811-1, openSUSE-SU-2024:13727-1
openSUSE Leap 15.4 rubygem-rack 2.0.8-150000.3.6.1 SUSE-SU-2022:2192-1
openSUSE Leap 15.3 rubygem-rack 2.0.8-150000.3.6.1 SUSE-SU-2022:2192-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 pcs +1 0.9.169-3.amzn2.1.2 ALAS2-2022-1895

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 pcs +1 0.9.169-3.0.1.el7_9.3 ELSA-2022-7343

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems rack < 2.0.9.1 2.0.9.1 GHSA-wq4h-7r42-5hrr
RubyGems rack >= 2.1, < 2.1.4.1 2.1.4.1 GHSA-wq4h-7r42-5hrr
RubyGems rack >= 2.2, < 2.2.3.1 2.2.3.1 GHSA-wq4h-7r42-5hrr

Advisories 23

References