Veracode Vulnerability DatabaseVERACODE:35745Regular Expression Denial Of Service (ReDoS)
0.001 Low
EPSS
Percentile
46.4%
rack is vulnerable to regular expression denial of service. The vulnerability exists because the BROKEN_QUOTED and BROKEN_UNQUOTED attributes in the Multipart module of multipart.rb does not properly restrict the broken mime parser, allowing an attacker to crash the application by providing malicious multipart POST requests
References
discuss.rubyonrails.org/t/cve-2022-30122-denial-of-service-vulnerability-in-rack-multipart-parsing/80729
github.com/advisories/GHSA-hxqx-xwvh-44m2
github.com/rack/rack/commit/41be3d7f3fd73ccf246ad97c3831d02f99d2ce84
github.com/rack/rack/commit/a872bcce127a6f4a0f16af8f28b686955ba32814
github.com/rack/rack/commit/ad699ca3f5822ce6c409ccd8f9fea898e61703fe
groups.google.com/g/ruby-security-ann/c/L2Axto442qk
Related
