Published: 09/02/2023 Updated: 08/12/2023

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 0

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Vulnerable Product	Search on Vulmon	Subscribe to Product
rack project rack

Debian Bug report logs - #1029832 ruby-rack: CVE-2022-44570 CVE-2022-44571 CVE-2022-44572 Package: src:ruby-rack; Maintainer for src:ruby-rack is Debian Ruby Team <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 28 Jan 2023 13:09:05 UTC Severity: ...

Several vulnerabilities were discovered in ruby-rack, a modular Ruby webserver interface, which may result in denial of service and shell escape sequence injection For the oldstable distribution (bullseye), these problems have been fixed in version 214-3+deb11u1 We recommend that you upgrade your ruby-rack packages For the detailed security st ...

Description This CVE is under investigation by Red Hat Product Security ...

CWE-1333 https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125 https://www.debian.org/security/2023/dsa-5530 https://security.netapp.com/advisory/ntap-20231208-0010/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029832 https://nvd.nist.gov https://www.debian.org/security/2023/dsa-5530

CVE-2022-44570

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect