Most recent entries from all

bdu:2022-04200

BREW-mailcatcher-CVE-2022-30122 — Denial of Service Vulnerability in Rack Multipart Parsing

Affected: Homebrew: mailcatcher

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122.

Versions Affected: >= 1.2 Not affected: < 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack's multipart parser to parse multipart posts. This includes directly using the multipart parser like this:

``` params = Rack::Multipart.parse_multipart(env) ```

But it also includes reading POST data from a Rack request object like this:

``` p request.POST # read POST data p request.params # reads both query params and POST data ```

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Workarounds There are no feasible workarounds for this issue.

certfr-2022-avi-506 — De multiples vulnérabilités ont été découvertes dans Ruby on Rails . Elles permettent à un attaquant de provoquer une e…

certfr-2022-avi-506

EUVD-2026-202803

fkie_cve-2022-30122

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

GHSA-hxqx-xwvh-44m2 — Denial of Service Vulnerability in Rack Multipart Parsing

Affected: RubyGems: rack

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122.

Versions Affected: >= 1.2 Not affected: < 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack's multipart parser to parse multipart posts. This includes directly using the multipart parser like this:

``` params = Rack::Multipart.parse_multipart(env) ```

But it also includes reading POST data from a Rack request object like this:

``` p request.POST # read POST data p request.params # reads both query params and POST data ```

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Workarounds There are no feasible workarounds for this issue.

gsd-2022-30122

OESA-2022-1729 — rubygem-rack security update

Affected: openEuler:20.03-LTS-SP1: rubygem-rack, openEuler:20.03-LTS-SP3: rubygem-rack, openEuler:22.03-LTS: rubygem-rack

Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Security Fix(es): Denial of Service Vulnerability in Rack Multipart Parsing(CVE-2022-30122) Possible shell escape sequence injection vulnerability in Rack(CVE-2022-30123) A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.(CVE-2020-8184)

openSUSE-SU-2024:12119-1 — ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media

ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media

RHSA-2022:7242 — Red Hat Security Advisory: Satellite 6.11.4 Async Security Update

rubygem-rack: crafted multipart POST request may cause a DoS rubygem-tzinfo: arbitrary code execution

SUSE-SU-2022:2192-1 — Security update for rubygem-rack

Security update for rubygem-rack

UBUNTU-CVE-2022-30122

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

WID-SEC-W-2022-0262 — Ruby: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um einen Denial of Service Angriff durchzuführen, einen Cross-Site-Scripting-Angriff durchzuführen oder beliebigen Programmcode auszuführen.