Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 895652 (CVE-2022-44570, CVE-2022-44571, CVE-2022-44572) - <dev-ruby/rack-{2.2.6.2,3.0.4.1}: multiple vulnerabilities
Summary: <dev-ruby/rack-{2.2.6.2,3.0.4.1}: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2022-44570, CVE-2022-44571, CVE-2022-44572
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa]
Keywords:
Depends on: 895664
Blocks:
  Show dependency tree
 
Reported: 2023-02-21 04:28 UTC by John Helmert III
Modified: 2023-08-02 05:44 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-02-21 04:28:29 UTC
CVE-2022-44570 (https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125):

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

CVE-2022-44571 (https://discuss.rubyonrails.org/t/cve-2022-44571-possible-denial-of-service-vulnerability-in-rack-content-disposition-parsing/82126):

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.

CVE-2022-44572 (https://hackerone.com/reports/1639882):

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Please stabilize 2.2.6.2.
Comment 1 Hans de Graaff gentoo-dev Security 2023-02-26 08:57:23 UTC
Cleanup done.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-02-27 15:52:03 UTC
(In reply to Hans de Graaff from comment #1)
> Cleanup done.

Looks like not? 2.2.4, 2.2.5, 3.0.3 all still in tree.
Comment 3 Hans de Graaff gentoo-dev Security 2023-07-22 05:01:41 UTC
I probably didn't push before commenting on the bug. In any case all vulnerable versions are no longer present now.
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-08-02 05:44:19 UTC
Thanks for notifying! Only DoS, no GLSA. All done!