Veracode Vulnerability DatabaseVERACODE:39001Regular Expression Denial Of Service (ReDoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
21.3%
rack is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability exists in get_filename function of parser.rb due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious input with a RFC2183-multipart-boundary string.
References
github.com/advisories/GHSA-rqv2-275x-2jq5
github.com/rack/rack/commit/8291f502b0e1dcf514cc25c34e4bf0beec7a92ae
github.com/rack/rack/commit/a493640cd89aec9c148bc9d22c5f938ca9ed0dfa
github.com/rack/rack/commit/dc50f8e495f67eb933b1fc33ebee550908d945e6
github.com/rack/rack/releases/tag/v2.0.9.2
github.com/rack/rack/releases/tag/v2.1.4.2
github.com/rack/rack/releases/tag/v3.0.4.1
github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-44572.yml
hackerone.com/reports/1639882
security.netapp.com/advisory/ntap-20231208-0014/
www.debian.org/security/2023/dsa-5530
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
21.3%