MEDIUM
GHSA-h77x-m5q8-c29h
Rack vulnerable to REDoS
Quick fix
GHSA-h77x-m5q8-c29h — rack: upgrade to the fixed version with the command below.
bundle update rackDetails
`lib/rack/multipart.rb` in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-6109[ADVISORY]
- https://github.com/rack/rack/commit/c9f65df37a151821eb88ddd1dc404b83e52c52d5[WEB]
- https://access.redhat.com/errata/RHSA-2013:0544[WEB]
- https://access.redhat.com/security/cve/CVE-2012-6109[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=895277[WEB]
- https://github.com/rack/rack[WEB]
- https://github.com/rack/rack/blob/master/README.rdoc[WEB]
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2012-6109.yml[WEB]
- https://groups.google.com/forum/#!msg/rack-devel/1w4_fWEgTdI/XAkSNHjtdTsJ[WEB]
- https://groups.google.com/forum/#%21msg/rack-devel/1w4_fWEgTdI/XAkSNHjtdTsJ[WEB]
- https://rhn.redhat.com/errata/RHSA-2013-0544.html[WEB]