Lucene search

K
mageiaGentoo FoundationMGASA-2024-0123
HistoryApr 12, 2024 - 11:45 p.m.

Updated ruby-rack packages fix security vulnerabilities

2024-04-1223:45:19
Gentoo Foundation
advisories.mageia.org
25
ruby-rack
security vulnerabilities
denial of service
redos
media type parser
range headers
header parsing

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). (CVE-2024-25126) Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications). (CVE-2024-26141) Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. (CVE-2024-26146)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchruby-rack< 2.2.8.1-1ruby-rack-2.2.8.1-1.mga9

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%