Denial of Service Vulnerability in Rack Multipart Parsing

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122. Versions Affected: = 1.2 Not affected: 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted multipart POST...

CVE-2022-30123

A flaw was found in ruby gem-rack. This flaw allows a malicious actor to craft requests that can cause shell escape sequences to be written to the terminal via rack's Lint middleware and CommonLogger middleware. This issue can leverage these escape sequences to execute commands in the victim's...

CVE-2022-30122

A denial of service flaw was found in ruby-rack. An attacker crafting multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a denial of service...

Vulnerabilities fixed in Ruby on Rails

Vulnerabilities have been fixed in Ruby on Rails. These vulnerabilities allow a malicious party to execute arbitrary code execute arbitrary code or potentially cause a denial-of-service when the package rack is in use for parsing and middleware. Updates have been made available for rack to addres...

OS Command Injection

rack is vulnerable to OS command injection. The vulnerability exists in log function in CommonLogger and Lint middleware because of the escape sequences which allows an attacker to execute shell commands...

Regular Expression Denial Of Service (ReDoS)

rack is vulnerable to regular expression denial of service. The vulnerability exists because the BROKENQUOTED and BROKENUNQUOTED attributes in the Multipart module of multipart.rb does not properly restrict the broken mime parser, allowing an attacker to crash the application by providing malicio...

Denial of Service (DoS)

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

Arbitrary Code Injection

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

GHSA-HXQX-XWVH-44M2 Denial of Service Vulnerability in Rack Multipart Parsing

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122. Versions Affected: = 1.2 Not affected: 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted multipart POST...

Denial of Service Vulnerability in Rack Multipart Parsing

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122. Versions Affected: = 1.2 Not affected: 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted multipart POST...

Possible shell escape sequence injection vulnerability in Rack

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted...

GHSA-WQ4H-7R42-5HRR Possible shell escape sequence injection vulnerability in Rack

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted...

PT-2022-3422

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.0.9.1 Rack versions prior to 2.1.4.1 Rack versions prior to 2.2.3.1 Description A possible denial of service vulnerability exists in the multipart parsing component of Rack. This issue is related to insufficient checki...

PT-2022-3423

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.0.9.1 Rack versions prior to 2.1.4.1 Rack versions prior to 2.2.3.1 Description A sequence injection vulnerability exists in Rack, which could allow a possible shell escape in the Lint and CommonLogger components. This...

[SECURITY] [DLA 3023-1] puma security update

Debian LTS Advisory DLA-3023-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 26, 2022 https://wiki.debian.org/LTS Package : puma Version : 3.6.0-1+deb9u2 CVE ID : CVE-2019-16770 CVE-2020-5247 CVE-2022-23634 Debian Bug : 946312 952766 1005391 Several security...

Debian DSA-5146-1 : puma - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5146 advisory. - Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain...

pcs security update

0.10.12-6.0.1.el86.1 - Replace HAM-logo.png with a generic one 0.10.12-6.el86.1 - Updated bundled rubygems: sinatra, rack-protection - Resolves: rhbz2081331...

Rack-Cache caches sensitive headers

The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache...

GHSA-HRP6-W4V2-8737 Rack-Cache caches sensitive headers

The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache...

GHSA-V6J3-7JRW-HQ2P Rack Gem Subject to Denial of Service via Hash Collisions

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...