905333 – (CVE-2023-27530) <dev-ruby/rack-{2.2.6.3,3.0.4.2}: DoS via multipart MIME prasing

Bug 905333 (CVE-2023-27530) - <dev-ruby/rack-{2.2.6.3,3.0.4.2}: DoS via multipart MIME prasing

Summary: <dev-ruby/rack-{2.2.6.3,3.0.4.2}: DoS via multipart MIME prasing

Status:	RESOLVED FIXED

Alias:	CVE-2023-27530

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://discuss.rubyonrails.org/t/cve...
Whiteboard:	B3 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2023-04-29 21:07 UTC by John Helmert III
Modified:	2023-05-07 16:38 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2023-04-29 21:07:56 UTC

CVE-2023-27530:

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

Please cleanup.

Comment 1 Larry the Git Cow gentoo-dev

2023-05-01 06:13:29 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d361bc459d3d18363af0e8adf8c2f65e7d0024f6

commit d361bc459d3d18363af0e8adf8c2f65e7d0024f6
Author:     Hans de Graaff <graaff@gentoo.org>
AuthorDate: 2023-05-01 05:59:28 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2023-05-01 06:13:26 +0000

    dev-ruby/rack: drop 2.2.6.2, 3.0.4.1
    
    Bug: https://bugs.gentoo.org/905333
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 dev-ruby/rack/Manifest            |  2 --
 dev-ruby/rack/rack-2.2.6.2.ebuild | 54 ---------------------------------------
 dev-ruby/rack/rack-3.0.4.1.ebuild | 45 --------------------------------
 3 files changed, 101 deletions(-)

Comment 2 John Helmert III archtester

2023-05-07 16:38:50 UTC

Thanks! Only a "soft" DoS, no GLSA. All done.