Rack vulnerabilities

2024-08-1900:00:00

ubuntu.com

ubuntu 20.04

ubuntu 22.04

denial of service

remote attacker

cve-2024-25126

cve-2024-26141

cve-2024-26146

range headers

crafted headers

resource consumption

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

AI Score

7.1

Confidence

Low

JSON

Releases

Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 ESM
Ubuntu 16.04 ESM
Ubuntu 14.04 ESM

Packages

ruby-rack - modular Ruby webserver interface

Details

It was discovered that Rack incorrectly parsed certain media types. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-25126)

It was discovered that Rack incorrectly handled certain Range headers. A
remote attacker could possibly use this issue to cause Rack to create
large responses, leading to a denial of service. (CVE-2024-26141)

It was discovered that Rack incorrectly handled certain crafted headers. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. (CVE-2024-26146)

OSVersionArchitecturePackageVersionFilename
Ubuntu22.04noarchruby-rack< 2.1.4-5ubuntu1+esm5UNKNOWN
Ubuntu22.04noarchruby-rack< 2.1.4-5ubuntu1UNKNOWN
Ubuntu20.04noarchruby-rack< 2.0.7-2ubuntu0.1+esm5UNKNOWN
Ubuntu20.04noarchruby-rack< 2.0.7-2ubuntu0.1UNKNOWN
Ubuntu18.04noarchruby-rack< 1.6.4-4ubuntu0.2+esm6UNKNOWN
Ubuntu18.04noarchruby-rack< 1.6.4-4ubuntu0.2UNKNOWN
Ubuntu16.04noarchruby-rack< 1.6.4-3ubuntu0.2+esm6UNKNOWN
Ubuntu16.04noarchruby-rack< 1.6.4-3ubuntu0.2UNKNOWN
Ubuntu14.04noarchruby-rack< 1.5.2-3+deb8u3ubuntu1~esm8UNKNOWN
Ubuntu14.04noarchlibrack-ruby< 1.5.2-1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	22.04	noarch	ruby-rack	< 2.1.4-5ubuntu1+esm5	UNKNOWN
Ubuntu	22.04	noarch	ruby-rack	< 2.1.4-5ubuntu1	UNKNOWN
Ubuntu	20.04	noarch	ruby-rack	< 2.0.7-2ubuntu0.1+esm5	UNKNOWN
Ubuntu	20.04	noarch	ruby-rack	< 2.0.7-2ubuntu0.1	UNKNOWN
Ubuntu	18.04	noarch	ruby-rack	< 1.6.4-4ubuntu0.2+esm6	UNKNOWN
Ubuntu	18.04	noarch	ruby-rack	< 1.6.4-4ubuntu0.2	UNKNOWN
Ubuntu	16.04	noarch	ruby-rack	< 1.6.4-3ubuntu0.2+esm6	UNKNOWN
Ubuntu	16.04	noarch	ruby-rack	< 1.6.4-3ubuntu0.2	UNKNOWN
Ubuntu	14.04	noarch	ruby-rack	< 1.5.2-3+deb8u3ubuntu1~esm8	UNKNOWN
Ubuntu	14.04	noarch	librack-ruby	< 1.5.2-1	UNKNOWN