Lucene search

GoogleOSV:GHSA-RGR4-9JH5-J4J6

HistoryOct 24, 2017 - 6:33 p.m.

Rack vulnerable to Denial of Service via large parameter depth request

2017-10-2418:33:36

Google

osv.dev

0.067 Low

EPSS

Percentile

93.8%

JSON

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

CPENameOperatorVersion
rackeq1.4.3
rackeq1.4.4
rackeq1.5.0
rackeq1.5.1
rackeq1.5.2
rackeq1.4.1
rackeq1.4.0
rackeq1.4.2
rackeq1.6.0
rackeq1.5.3

Name	Operator	Version
rack	eq	1.4.3
rack	eq	1.4.4
rack	eq	1.5.0
rack	eq	1.5.1
rack	eq	1.5.2
rack	eq	1.4.1
rack	eq	1.4.0
rack	eq	1.4.2
rack	eq	1.6.0
rack	eq	1.5.3

Rows per page:

1-10 of 121

References

lists.fedoraproject.org/pipermail/package-announce/2015-August/164173.html

lists.fedoraproject.org/pipermail/package-announce/2015-August/165180.html

lists.opensuse.org/opensuse-updates/2015-07/msg00040.html

lists.opensuse.org/opensuse-updates/2015-07/msg00043.html

lists.opensuse.org/opensuse-updates/2015-07/msg00044.html

openwall.com/lists/oss-security/2015/06/16/14

rhn.redhat.com/errata/RHSA-2015-2290.html

www.debian.org/security/2015/dsa-3322

github.com/rack/rack

github.com/rack/rack/blob/master/HISTORY.md

github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2015-3225.yml

groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc

nvd.nist.gov/vuln/detail/CVE-2015-3225

0.067 Low

EPSS

Percentile

93.8%

JSON

Related for OSV:GHSA-RGR4-9JH5-J4J6