GHSA-c6qg-cjj8-47qp CVE-2023-27539
Possible Denial of Service Vulnerability in Rack's header parsing
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.06%
- Chance of exploitation in the next 30 days. Higher than 64.50% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
2.2.6.4- Upgrade rack to this version or later
Description
There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.
Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1
Impact
Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.
Workarounds
Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
Affected versions
RubyGems
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rack RubyGems → 2.2.6.4
- bundler
bundle update rack # Gemfile: gem "rack", ">= 2.2.6.4"
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
References
Advisories
Packages
Other links
- github.com/rack/rack/commit/231ef369ad0b542575fb36c74fcfcfabcf6c530c
- github.com/rack/rack/commit/ee7919ea04303717858be1c3f16b406adc6d8cff
- discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-h…
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2023-27539.yml
- lists.debian.org/debian-lts-announce/2023/04/msg00017.html
- security.netapp.com/advisory/ntap-20231208-0016
- debian.org/security/2023/dsa-5530
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g2pf-xv49-m2h5 Rack::Request accepts invalid Host characters, enabling host allowlist bypass | Medium | Also affects rack |
| GHSA-v6x5-cg8r-vv6x Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters | High | Also affects rack |
| GHSA-qfgr-crr9-7r49 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing | Medium | Also affects rack |
| GHSA-rx22-g9mx-qrhv Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values | Medium | Also affects rack |
| GHSA-q2ww-5357-x388 Rack has Content-Length mismatch in Rack::Files error responses | Medium | Also affects rack |
| GHSA-qv7j-4883-hwh7 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect | High | Also affects rack |
| GHSA-8vqr-qjwx-82mw Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads | High | Also affects rack |
| GHSA-x8cg-fq8g-mxfx Rack's multipart byte range processing allows denial of service via excessive overlapping ranges | High | Also affects rack |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor