Input validation error in Rack - CVE-2023-27539

Vulnerability identifier: #VU74199

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-27539

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing HTTP headers. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Rack
Debian Linux
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE OpenStack Cloud Crowbar
Anolis OS
Ubuntu
SUSE Linux Enterprise Server 15 SP1 Business Critical Linux
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
openSUSE Leap
Fedora
IBM Cloud Pak for Multicloud Management
OpenShift Logging
IBM Watson Discovery for IBM Cloud Pak for Data
Red Hat Satellite
ruby-rack (Ubuntu package)
pcs (Red Hat package)
pcs-snmp
pcs
ruby2.1-rubygem-rack
ruby2.5-rubygem-rack-doc
ruby2.5-rubygem-rack
ruby2.5-rubygem-rack-testsuite
ruby-rack (Debian package)
rubygem-rack
Cloud Pak for Data

Install updates from vendor's website.

Rack - addressed in versions 2.2.6.4, 3.0.6.1
IBM Cloud Pak for Multicloud Management - update to 2.3.8
OpenShift Logging - addressed in versions 5.6.5, 5.7.2
ruby-rack (Ubuntu package) - addressed in versions Ubuntu Pro, 2.1.4-5ubuntu1.1, 2.2.4-3ubuntu0.1
pcs (Red Hat package) - addressed in versions 0.10.8-1.el8_4.4, 0.10.12-6.el8_6.4, 0.10.15-4.el8_8.1, 0.11.1-10.el9_0.4, 0.11.4-7.el9_2
pcs-snmp - update to 0.10.15-4.0.1
pcs - update to 0.10.15-4.0.1
ruby2.1-rubygem-rack - update to 1.6.13-3.19.1
ruby2.5-rubygem-rack-doc - update to 2.0.8-150000.3.18.1
ruby2.5-rubygem-rack - update to 2.0.8-150000.3.18.1
ruby2.5-rubygem-rack-testsuite - update to 2.0.8-150000.3.18.1
ruby-rack (Debian package) - update to 2.1.4-3+deb11u1
rubygem-rack - addressed in versions 2.2.21-1.fc41, 2.2.21-9.fc42
Cloud Pak for Data - update to 4.8.5
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Red Hat Satellite - update to 6.14

• https://bugzilla.redhat.com/show_bug.cgi?id=2179649
• https://github.com/rack/rack/commit/231ef369ad0b542575fb36c74fcfcfabcf6c530c

• Denial of service in Rack for Ruby
• SUSE update for rubygem-rack
• SUSE update for rubygem-rack
• Red Hat Enterprise Linux 9.0 Extended Update Support update for pcs
• Red Hat Enterprise Linux 8.4 Extended Update Support update for pcs
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.6
• Red Hat Enterprise Linux 9 update for pcs
• Red Hat Enterprise Linux 8 update for pcs
• Red Hat Enterprise Linux 8.6 Extended Update Support update for pcs
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.7
• Debian update for ruby-rack
• Multiple vulnerabilities in Red Hat Satellite 6.14
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Ubuntu update for ruby-rack
• Ubuntu update for ruby-rack
• Input validation error in IBM Cloud Pak for Data
• Ubuntu update for ruby-rack
• Multiple vulnerabilities in IBM Watson Discovery
• Anolis OS update for pcs
• Fedora 42 update for rubygem-rack
• Fedora 41 update for rubygem-rack