Most recent entries from all

ALSA-2023:2652 — Important: pcs security and bug fix update

Affected: AlmaLinux:9: pcs, AlmaLinux:9: pcs-snmp

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* pcs: webpack: Regression of CVE-2023-28154 fixes in the AlmaLinux (CVE-2023-2319) * rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530) * rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697) * Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704) * [WebUI] fence levels prevent loading of cluster status (BZ#2183180)

bdu:2023-01752

BREW-mailcatcher-CVE-2023-27530 — Rack has possible DoS Vulnerability in Multipart MIME parsing

Affected: Homebrew: mailcatcher

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

# Impact The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Workarounds A proxy can be configured to limit the POST body size which will mitigate this issue.

EUVD-2026-195678

fkie_cve-2023-27530

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

GHSA-3h57-hmj3-gj3p — Rack has possible DoS Vulnerability in Multipart MIME parsing

Affected: RubyGems: rack

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Workarounds A proxy can be configured to limit the POST body size which will mitigate this issue.

gsd-2023-27530

openSUSE-SU-2024:12773-1 — ruby3.1-rubygem-rack-3.0.4.2-1.1 on GA media

ruby3.1-rubygem-rack-3.0.4.2-1.1 on GA media

RHSA-2023:1961 — Red Hat Security Advisory: pcs security and bug fix update

rubygem-rack: Denial of service in Multipart MIME parsing rubygem-rack: denial of service in header parsing

SUSE-SU-2023:0725-1 — Security update for rubygem-rack

Security update for rubygem-rack

UBUNTU-CVE-2023-27530

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack

WID-SEC-W-2023-0559 — Ruby on Rails: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen.