2280 matches found
GHSA-22F2-V57C-J9CX vulnerabilities
Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...
GHSA-22F2-V57C-J9CX Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
Summary ruby module Rack class MediaType SPLITPATTERN = %r\s;,\s The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split. PoC A simple HTTP request with lots of blank characters in the content-type header: ruby request"Content-Type" = " "...
GHSA-22F2-V57C-J9CX vulnerabilities
Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...
Rack has possible DoS Vulnerability with Range Header
Possible DoS Vulnerability with Range Header in Rack There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: = 1.3.0. Not affected: 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact...
GHSA-XJ5V-6V4G-JFW6 vulnerabilities
Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...
GHSA-XJ5V-6V4G-JFW6 Rack has possible DoS Vulnerability with Range Header
Possible DoS Vulnerability with Range Header in Rack There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: = 1.3.0. Not affected: 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact...
GHSA-54RR-7FVW-6X8F vulnerabilities
Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...
Rack Header Parsing leads to Possible Denial of Service Vulnerability
Possible Denial of Service Vulnerability in Rack Header Parsing There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4,...
GHSA-54RR-7FVW-6X8F Rack Header Parsing leads to Possible Denial of Service Vulnerability
Possible Denial of Service Vulnerability in Rack Header Parsing There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4,...
GHSA-54RR-7FVW-6X8F vulnerabilities
Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...
Regular Expression Denial Of Service (ReDoS)
rack is vulnerable to a Denial Of Service. This vulnerability is due the handling of content type parsing which utilizes a regex pattern with inefficient complexity, which allows attackers to launch DoS attacks...
PT-2024-28440 · Rack · Rack
Name of the Vulnerable Software and Affected Versions: Rack versions 3.1.0 through 3.1.4 Rack versions prior to 2.0.9.4 Rack versions prior to 2.1.4.4 Rack versions prior to 2.2.8.1 Rack versions prior to 3.0.9.1 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in th...
Rack Security Vulnerabilities
Rack is the modular Ruby web server interface. A security vulnerability in Rack versions prior to 2.0.9.4, prior to 2.1.4.4, prior to 2.2.8.1, and prior to 3.0.9.1 stems from a carefully crafted header that could cause Rack's media type parser to take longer than expected, resulting in a denial o...
Rack Resource Management Error Vulnerability
Rack is a modular Ruby web server interface. A resource management error vulnerability exists in Rack versions prior to 3.0.9.1, 2.2.8.1, and 2.2.8.1, which stems from a crafted Range header that may cause the server to respond abnormally, resulting in a denial of service...
Rack Security Vulnerabilities
Rack is a modular Ruby web server interface. A security vulnerability exists in Rack versions prior to 3.0.9.1, 2.2.8.1, and 2.2.8.1, which stems from a carefully crafted content type header that could cause Rack's media type parser to take longer than expected, resulting in a denial of service...
Insecure File Permissions
rack-cors is vulnerable to Insecure File Permissions. The vulnerability is due to the distribution of files with world-writable permissions. This can potentially lead to unauthorized disclosure or modification...
CVE-2024-27456
An insecure file permission flaw was found in rack-cors. The permissions for .rb files distributed with rack-cors ruby gem are set to 0666 by default, which may allow users with low privileges to edit files. This issue impacts integrity, confidentiality, and availability...
Rack CORS Middleware has Insecure File Permissions
rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...
