GHSA-rgr4-9jh5-j4j6 CVE-2015-3225
Rack vulnerable to Denial of Service via large parameter depth request
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 7.99%
- Chance of exploitation in the next 30 days. Higher than 94.76% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
1.5.4- Upgrade rack to this version or later
Description
lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rack | >= 1.5.0, < 1.5.4 |
1.5.4 |
| rack | >= 1.6.0, < 1.6.2 |
1.6.2 |
| rack | >= 1.4.0, < 1.4.6 |
1.4.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rack RubyGems → 1.5.4
- bundler
bundle update rack # Gemfile: gem "rack", ">= 1.5.4"
References
Advisories
Packages
Other links
- github.com/rack/rack/blob/master/HISTORY.md
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2015-3225.yml
- groups.google.com/forum
- lists.fedoraproject.org/pipermail/package-announce/2015-August/164173.html
- lists.fedoraproject.org/pipermail/package-announce/2015-August/165180.html
- lists.opensuse.org/opensuse-updates/2015-07/msg00040.html
- lists.opensuse.org/opensuse-updates/2015-07/msg00043.html
- lists.opensuse.org/opensuse-updates/2015-07/msg00044.html
- openwall.com/lists/oss-security/2015/06/16/14
- rhn.redhat.com/errata/RHSA-2015-2290.html
- debian.org/security/2015/dsa-3322
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g2pf-xv49-m2h5 Rack::Request accepts invalid Host characters, enabling host allowlist bypass | Medium | Also affects rack |
| GHSA-v6x5-cg8r-vv6x Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters | High | Also affects rack |
| GHSA-qfgr-crr9-7r49 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing | Medium | Also affects rack |
| GHSA-rx22-g9mx-qrhv Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values | Medium | Also affects rack |
| GHSA-q2ww-5357-x388 Rack has Content-Length mismatch in Rack::Files error responses | Medium | Also affects rack |
| GHSA-qv7j-4883-hwh7 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect | High | Also affects rack |
| GHSA-8vqr-qjwx-82mw Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads | High | Also affects rack |
| GHSA-x8cg-fq8g-mxfx Rack's multipart byte range processing allows denial of service via excessive overlapping ranges | High | Also affects rack |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor