Resource exhaustion in Rack - CVE-2022-44572

Vulnerability identifier: #VU71978

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-44572

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing Content-Disposition header in lib/rack/multipart/parser.rb. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Rack
Debian Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Ubuntu
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Fedora
ruby-rack (Ubuntu package)
ruby2.5-rubygem-rack-doc
ruby2.5-rubygem-rack-testsuite
ruby2.5-rubygem-rack
ruby-rack (Debian package)
rubygem-rack
rubygem-rack-help
IBM Watson Discovery for IBM Cloud Pak for Data
Red Hat Satellite

Install updates from vendor's website.

Rack - addressed in versions 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1
ruby-rack (Ubuntu package) - addressed in versions Ubuntu Pro, 2.1.4-5ubuntu1.1
ruby2.5-rubygem-rack-doc - update to 2.0.8-150000.3.12.1
ruby2.5-rubygem-rack-testsuite - update to 2.0.8-150000.3.12.1
ruby2.5-rubygem-rack - update to 2.0.8-150000.3.12.1
ruby-rack (Debian package) - update to 2.1.4-3+deb11u1
rubygem-rack - addressed in versions 2.2.3.1-4, 2.2.3.1-5
rubygem-rack-help - addressed in versions 2.2.3.1-4, 2.2.3.1-5
rubygem-rack - addressed in versions 2.2.21-1.fc41, 2.2.21-9.fc42
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Red Hat Satellite - update to 6.14

• https://github.com/rack/rack/commit/a493640cd89aec9c148bc9d22c5f938ca9ed0dfa
• https://bugzilla.redhat.com/show_bug.cgi?id=2164722
• https://bugzilla.suse.com/show_bug.cgi?id=1207596

• Multiple vulnerabilities in Rack for Ruby
• SUSE update for rubygem-rack
• Ubuntu update for ruby-rack
• Debian update for ruby-rack
• Multiple vulnerabilities in Red Hat Satellite 6.14
• openEuler 20.03 LTS SP4 update for rubygem-rack
• openEuler 22.03 LTS SP4 update for rubygem-rack
• openEuler 22.03 LTS SP1 update for rubygem-rack
• openEuler 22.03 LTS SP3 update for rubygem-rack
• Ubuntu update for ruby-rack
• Multiple vulnerabilities in IBM Watson Discovery
• Fedora 42 update for rubygem-rack
• Fedora 41 update for rubygem-rack