CVE-2024-25126 Rack ReDos in content type parsing (2nd degree polynomial)

2024-02-2823:28:07

CWE-1333

GitHub_M

github.com

rack

ruby

web server

content type parsing

cve-2024-25126

denial of service

vulnerability

patched

redos

polynomial

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

6.5

Confidence

High

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:rack_project:rack:3.0.0:rc1:*:*:*:ruby:*:*"
    ],
    "vendor": "rack_project",
    "product": "rack",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0",
        "lessThan": "3.0.9.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0.4",
        "lessThan": "2.2.8.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]