From 6d33da93ed041be803c1a7d8557de847097b9f61 Mon Sep 17 00:00:00 2001 From: Yasuhiro Kimura Date: Thu, 19 Jan 2023 10:42:49 +0900 Subject: [PATCH] security/vuxml: Document multiple vulnerabilities in rack --- security/vuxml/vuln/2023.xml | 68 ++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 3f6020461e6e8..0ece6c1c69397 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,71 @@ + + rack -- Multiple vulnerabilities + + + rubygem-rack + 3.0.4.1,3 + + + rubygem-rack22 + 2.2.6.2,3 + + + rubygem-rack16 + 1.6.14 + + + + +

Aaron Patterson reports:

+
+
+
CVE-2022-44570
+
+ Carefully crafted input can cause the Range header + parsing component in Rack to take an unexpected amount + of time, possibly resulting in a denial of service + attack vector. Any applications that deal with Range + requests (such as streaming applications, or + applications that serve files) may be impacted. +
+
CVE-2022-44571
+
+ Carefully crafted input can cause Content-Disposition + header parsing in Rack to take an unexpected amount of + time, possibly resulting in a denial of service attack + vector. This header is used typically used in multipart + parsing. Any applications that parse multipart posts + using Rack (virtually all Rails applications) are + impacted. +
+
CVE-2022-44572
+
+ Carefully crafted input can cause RFC2183 multipart + boundary parsing in Rack to take an unexpected amount of + time, possibly resulting in a denial of service attack + vector. Any applications that parse multipart posts + using Rack (virtually all Rails applications) are + impacted. +
+
+
+ + + + CVE-2022-44570 + CVE-2022-44571 + CVE-2022-44572 + https://github.com/rack/rack/blob/v3.0.4.1/CHANGELOG.md + https://github.com/advisories/GHSA-65f5-mfpf-vfhj + https://github.com/advisories/GHSA-93pm-5p5f-3ghx + https://github.com/advisories/GHSA-rqv2-275x-2jq5 + + + 2023-01-17 + 2023-01-19 + + + Apache httpd -- Multiple vulnerabilities