Input validation error in Rack - CVE-2024-26141

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU87009

Input validation error in Rack - CVE-2024-26141

Published: March 4, 2024


Vulnerability identifier: #VU87009
CSH Severity: Medium
CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-26141
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the Range request header in Rack. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

Rack
Debian Linux
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
Anolis OS
Red Hat Enterprise Linux for x86_64
Ubuntu
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
openSUSE Leap
openEuler
Fedora
Red Hat Satellite
IBM Watson Discovery for IBM Cloud Pak for Data
ruby-rack (Ubuntu package)
pcs (Red Hat package)
pcs
pcs-snmp
foreman-fapolicyd (Red Hat package)
pulpcore-obsolete-packages (Red Hat package)
ruby2.5-rubygem-rack-testsuite
ruby2.5-rubygem-rack-doc
ruby2.5-rubygem-rack
ruby-rack (Debian package)
rubygem-rack
rubygem-rack-help
rubygem-rack (Red Hat package)
python-pulp-container (Red Hat package)
rubygem-smart_proxy_ansible (Red Hat package)
foreman (Red Hat package)
foreman-installer (Red Hat package)
rubygem-katello (Red Hat package)
rubygem-actioncable (Red Hat package)
rubygem-rails (Red Hat package)
rubygem-activesupport (Red Hat package)
rubygem-activestorage (Red Hat package)
rubygem-activerecord (Red Hat package)
rubygem-activemodel (Red Hat package)
rubygem-activejob (Red Hat package)
rubygem-actionview (Red Hat package)
rubygem-actiontext (Red Hat package)
rubygem-actionpack (Red Hat package)
rubygem-actionmailer (Red Hat package)
rubygem-actionmailbox (Red Hat package)
rubygem-railties (Red Hat package)
satellite (Red Hat package)
puppetserver (Red Hat package)
rubygem-foreman_rh_cloud (Red Hat package)
Cloud Pak for Data

How to mitigate CVE-2024-26141

Install updates from vendor's website.

Rack - addressed in versions 2.2.8.1, 3.0.9.1
Red Hat Satellite - update to 6.15.5
ruby-rack (Ubuntu package) - addressed in versions Ubuntu Pro, 2.1.4-5ubuntu1.1, 2.2.4-3ubuntu0.1, 2.2.4-3ubuntu0.2, 2.2.7-1ubuntu0.1
pcs (Red Hat package) - addressed in versions 0.10.4-6.el8_2.5, 0.10.8-1.el8_4.5, 0.10.12-6.el8_6.5, 0.10.15-4.el8_8.2, 0.10.18-2.el8_10, 0.11.1-10.el9_0.5, 0.11.4-7.el9_2.1, 0.11.7-2.el9_4
pcs - update to 0.10.18-2.0.1
pcs-snmp - update to 0.10.18-2.0.1
foreman-fapolicyd (Red Hat package) - update to 1.0.1-3.el8sat
pulpcore-obsolete-packages (Red Hat package) - update to 1.0-10.el8pc
ruby2.5-rubygem-rack-testsuite - update to 2.0.8-150000.3.21.2
ruby2.5-rubygem-rack-doc - update to 2.0.8-150000.3.21.2
ruby2.5-rubygem-rack - update to 2.0.8-150000.3.21.2
ruby-rack (Debian package) - addressed in versions 2.1.4-3+deb11u2, 2.2.6.4-1+deb12u1
rubygem-rack - addressed in versions 2.2.3.1-4, 2.2.3.1-5
rubygem-rack-help - addressed in versions 2.2.3.1-4, 2.2.3.1-5
rubygem-rack (Red Hat package) - update to 2.2.8.1-1.el8sat
rubygem-rack - addressed in versions 2.2.21-1.fc41, 2.2.21-9.fc42
python-pulp-container (Red Hat package) - update to 2.16.9-2.el8pc
rubygem-smart_proxy_ansible (Red Hat package) - update to 3.5.6-0.1.el8sat
foreman (Red Hat package) - update to 3.9.1.12-1.el8sat
foreman-installer (Red Hat package) - update to 3.9.3.7-1.el8sat
Cloud Pak for Data - update to 4.8.5
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
rubygem-katello (Red Hat package) - update to 4.11.0.19-1.el8sat
rubygem-actioncable (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-rails (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activesupport (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activestorage (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activerecord (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activemodel (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activejob (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actionview (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actiontext (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actionpack (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actionmailer (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actionmailbox (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-railties (Red Hat package) - update to 6.1.7.7-2.el8sat
satellite (Red Hat package) - update to 6.15.5-1.el8sat
puppetserver (Red Hat package) - update to 7.17.2-1.el8sat
rubygem-foreman_rh_cloud (Red Hat package) - update to 9.0.59-1.el8sat

External References

Related Security Bulletins