GHSA-h77x-m5q8-c29h CVE-2012-6109
Rack vulnerable to REDoS
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 2.72%
- Chance of exploitation in the next 30 days. Higher than 86.02% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
1.1.4- Upgrade rack to this version or later
Description
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rack | < 1.1.4 |
1.1.4 |
| rack | >= 1.2.0, < 1.2.6 |
1.2.6 |
| rack | >= 1.3.0, < 1.3.7 |
1.3.7 |
| rack | >= 1.4.0, < 1.4.2 |
1.4.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rack RubyGems → 1.1.4
- bundler
bundle update rack # Gemfile: gem "rack", ">= 1.1.4"
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Other links
- github.com/rack/rack/commit/c9f65df37a151821eb88ddd1dc404b83e52c52d5
- access.redhat.com/errata/RHSA-2013:0544
- access.redhat.com/security/cve/CVE-2012-6109
- bugzilla.redhat.com/show_bug.cgi
- github.com/rack/rack
- github.com/rack/rack/blob/master/README.rdoc
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2012-6109.yml
- groups.google.com/forum
- groups.google.com/forum
- rhn.redhat.com/errata/RHSA-2013-0544.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g2pf-xv49-m2h5 Rack::Request accepts invalid Host characters, enabling host allowlist bypass | Medium | Also affects rack |
| GHSA-v6x5-cg8r-vv6x Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters | High | Also affects rack |
| GHSA-qfgr-crr9-7r49 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing | Medium | Also affects rack |
| GHSA-rx22-g9mx-qrhv Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values | Medium | Also affects rack |
| GHSA-q2ww-5357-x388 Rack has Content-Length mismatch in Rack::Files error responses | Medium | Also affects rack |
| GHSA-qv7j-4883-hwh7 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect | High | Also affects rack |
| GHSA-8vqr-qjwx-82mw Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads | High | Also affects rack |
| GHSA-x8cg-fq8g-mxfx Rack's multipart byte range processing allows denial of service via excessive overlapping ranges | High | Also affects rack |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor