Most recent entries from all

bdu:2022-04201

BREW-mailcatcher-CVE-2022-30123 — Possible shell escape sequence injection vulnerability in Rack

Affected: Homebrew: mailcatcher

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact Carefully crafted requests can cause shell escape sequences to be written to the terminal via Rack's Lint middleware and CommonLogger middleware. These escape sequences can be leveraged to possibly execute commands in the victim's terminal.

Impacted applications will have either of these middleware installed, and vulnerable apps may have something like this:

``` use Rack::Lint ```

``` use Rack::CommonLogger ```

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Workarounds Remove these middleware from your application

certfr-2022-avi-506 — De multiples vulnérabilités ont été découvertes dans Ruby on Rails . Elles permettent à un attaquant de provoquer une e…

certfr-2022-avi-506

EUVD-2026-16418

fkie_cve-2022-30123

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

GHSA-wq4h-7r42-5hrr — Possible shell escape sequence injection vulnerability in Rack

Affected: RubyGems: rack

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1

Impacted applications will have either of these middleware installed, and vulnerable apps may have something like this:

``` use Rack::Lint ```

``` use Rack::CommonLogger ```

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Workarounds Remove these middleware from your application

gsd-2022-30123

OESA-2022-1729 — rubygem-rack security update

Affected: openEuler:20.03-LTS-SP1: rubygem-rack, openEuler:20.03-LTS-SP3: rubygem-rack, openEuler:22.03-LTS: rubygem-rack

Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Security Fix(es): Denial of Service Vulnerability in Rack Multipart Parsing(CVE-2022-30122) Possible shell escape sequence injection vulnerability in Rack(CVE-2022-30123) A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.(CVE-2020-8184)

openSUSE-SU-2024:12119-1 — ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media

ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media

RHSA-2023:0632 — Red Hat Security Advisory: Red Hat OpenShift (Logging Subsystem) security update

rubygem-rack: crafted requests can cause shell escape sequences golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

SUSE-SU-2022:2192-1 — Security update for rubygem-rack

Security update for rubygem-rack

UBUNTU-CVE-2022-30123

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

WID-SEC-W-2022-0262 — Ruby: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um einen Denial of Service Angriff durchzuführen, einen Cross-Site-Scripting-Angriff durchzuführen oder beliebigen Programmcode auszuführen.