Affected: Homebrew: mailcatcher
There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122.
Versions Affected: >= 1.2 Not affected: < 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1
## Impact Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.
Impacted code will use Rack's multipart parser to parse multipart posts. This includes directly using the multipart parser like this:
``` params = Rack::Multipart.parse_multipart(env) ```
But it also includes reading POST data from a Rack request object like this:
``` p request.POST # read POST data p request.params # reads both query params and POST data ```
All users running an affected release should either upgrade or use one of the workarounds immediately.
## Workarounds There are no feasible workarounds for this issue.
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.
Affected: RubyGems: rack
There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122.
Versions Affected: >= 1.2 Not affected: < 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1
## Impact Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.
Impacted code will use Rack's multipart parser to parse multipart posts. This includes directly using the multipart parser like this:
``` params = Rack::Multipart.parse_multipart(env) ```
But it also includes reading POST data from a Rack request object like this:
``` p request.POST # read POST data p request.params # reads both query params and POST data ```
All users running an affected release should either upgrade or use one of the workarounds immediately.
## Workarounds There are no feasible workarounds for this issue.
Affected: openEuler:20.03-LTS-SP1: rubygem-rack, openEuler:20.03-LTS-SP3: rubygem-rack, openEuler:22.03-LTS: rubygem-rack
Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Security Fix(es): Denial of Service Vulnerability in Rack Multipart Parsing(CVE-2022-30122) Possible shell escape sequence injection vulnerability in Rack(CVE-2022-30123) A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.(CVE-2020-8184)
ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media
rubygem-rack: crafted multipart POST request may cause a DoS rubygem-tzinfo: arbitrary code execution
Security update for rubygem-rack
Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um einen Denial of Service Angriff durchzuführen, einen Cross-Site-Scripting-Angriff durchzuführen oder beliebigen Programmcode auszuführen.