Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 925208 (CVE-2024-25126, CVE-2024-26141, CVE-2024-26146) - <dev-ruby/rack-{2.2.8.1,3.0.9.1}: multiple vulnerabilities
Summary: <dev-ruby/rack-{2.2.8.1,3.0.9.1}: multiple vulnerabilities
Status: CONFIRMED
Alias: CVE-2024-25126, CVE-2024-26141, CVE-2024-26146
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://rubyonrails.org/2024/2/21/Rai...
Whiteboard: B3 [stable]
Keywords:
Depends on: 925296
Blocks:
  Show dependency tree
 
Reported: 2024-02-22 06:24 UTC by Hans de Graaff
Modified: 2024-02-23 07:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hans de Graaff gentoo-dev Security 2024-02-22 06:24:51 UTC 
There is a possible denial of service vulnerability in the content type parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2024-25126.

Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions: 3.0.9.1, 2.2.8.1
Impact


There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.

Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1


There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1