GitHub Advisory DatabaseGHSA-RGR4-9JH5-J4J6

HistoryOct 24, 2017 - 6:33 p.m.

Rack vulnerable to Denial of Service via large parameter depth request

2017-10-2418:33:36

GitHub Advisory Database

github.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.067 Low

EPSS

Percentile

93.8%

JSON

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

Affected configurations

Vulners

Node

github_advisory_databaserackRange<1.4.6

github_advisory_databaserackRange<1.5.4

github_advisory_databaserackRange<1.6.2

CPENameOperatorVersion
racklt1.4.6
racklt1.5.4
racklt1.6.2

Name	Operator	Version
rack	lt	1.4.6
rack	lt	1.5.4
rack	lt	1.6.2

References

lists.fedoraproject.org/pipermail/package-announce/2015-August/164173.html

lists.fedoraproject.org/pipermail/package-announce/2015-August/165180.html

lists.opensuse.org/opensuse-updates/2015-07/msg00040.html

lists.opensuse.org/opensuse-updates/2015-07/msg00043.html

lists.opensuse.org/opensuse-updates/2015-07/msg00044.html

openwall.com/lists/oss-security/2015/06/16/14

rhn.redhat.com/errata/RHSA-2015-2290.html

www.debian.org/security/2015/dsa-3322

github.com/advisories/GHSA-rgr4-9jh5-j4j6

github.com/rack/rack/blob/master/HISTORY.md

github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2015-3225.yml

groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc

nvd.nist.gov/vuln/detail/CVE-2015-3225

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.067 Low

EPSS

Percentile

93.8%

JSON

Related for GHSA-RGR4-9JH5-J4J6