PT-2019-6072 · Ruby +2 · Rack-Cors +2

Name of the Vulnerable Software and Affected Versions: rack-cors versions prior to 1.0.4 Description: The issue allows for ../ directory traversal, enabling access to private resources. This is due to the fact that resource matching does not ensure pathnames are in a canonical format. The...

rubygem-rack: Buffer size in multipart parser allows for denial of service

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size...

The vulnerability of the Rack module in the Ruby programming language allows attackers to compromise data integrity.

The vulnerability of the Rack module in the Ruby programming language is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

V-SOL GPON/EPON OLT Platform 2.03 Cross Site Request Forgery

V-SOL GPON/EPON OLT Platform v2.03 Cross-Site Request Forgery Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd. Product web page: https://www.vsolcn.com Affected version: V2.03.62RIPv6 V2.03.54R V2.03.52R V2.03.49 V2.03.47 V2.03.40 V2.03.26 V2.03.24 V1.8.6 V1.4 Summary: GPON is current...

Ubuntu 16.04 LTS / 18.04 LTS : Rack vulnerability (USN-4089-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4089-1 advisory. It was discovered that Rack incorrectly handled carefully crafted requests. A remote attacker could use this issue to execute a cross-site scripting X...

NewStart CGSL CORE 5.04 / MAIN 5.04 : pcs Multiple Vulnerabilities (NS-SA-2019-0042)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pcs packages installed that are affected by multiple vulnerabilities: - Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in...

FreeBSD : FreeBSD -- Resource exhaustion in non-default RACK TCP stack (c294c2e6-b309-11e9-a87f-a4badb2f4699) (ERC)

While processing acknowledgements, the RACK code uses several linked lists to maintain state entries. A malicious attacker can cause the lists to grow unbounded. This can cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service...

Ubuntu: Security Advisory (USN-4089-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4089-1 ruby-rack vulnerability

It was discovered that Rack incorrectly handled carefully crafted requests. A remote attacker could use this issue to execute a cross-site scripting XSS attack...

CVE-2019-5599

In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a...

CVE-2019-5599

In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a...

Path traversal

In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a...

CVE-2019-5599

CVE-2019-5599 affects FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6. A bug in the non-default RACK TCP stack can cause several linked lists to grow unbounded, triggering an expensive list traversal per processed packet and leading to resource exhaustion and denial of ...

CVE-2019-5599

Removed by vendor...

The vulnerability of the RACK module in the FreeBSD operating system, which allows a hacker to trigger a service failure

The vulnerability of the RACK module in the FreeBSD operating system arises due to errors in processing segments of minimal size. Exploiting this vulnerability allows a remote attacker to cause a service failure by sending a specially crafted sequence of SACK packets...

FreeBSD -- Resource exhaustion in non-default RACK TCP stack

Problem Description: While processing acknowledgements, the RACK code uses several linked lists to maintain state entries. A malicious attacker can cause the lists to grow unbounded. This can cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-1570) (SACK Panic) (SACK Slowness)

Example: The openSUSE Leap 42.3 kernel was updated to 4.4.180 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-11477: A sequence of SACKs may have been crafted by a remote attacker such that one can trigger an integer overflow, leading to a kernel pani...

FreeBSD-SA-19:08.rack

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:08.rack Security Advisory The FreeBSD Project Topic: Resource exhaustion in non-default RACK TCP stack Category: core Module: inet Announced: 2019-06-19...

PT-2019-2419 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.0-STABLE before r349197 FreeBSD versions 12.0-RELEASE before 12.0-RELEASE-p6 Description: The issue is caused by a bug in the non-default RACK TCP stack, allowing an attacker to cause linked lists to grow unbounded, leadin...

openSUSE Security Update : rubygem-rack (openSUSE-2019-1553)

This update for rubygem-rack fixes the following issues : Security issued fixed : - CVE-2018-16471: Fixed a cross-site scripting vulnerability via 'scheme' method bsc1116600. This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...