Asymmetric denial of service - ReDoS In ruby-rack
Description
Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 2.1.4-3+deb11u2 | ||
debian 12 | 2.2.6.4-1+deb12u1 | ||
debian 13 | 2.2.7-1.1 | ||
debian 14 | 2.2.7-1.1 | ||
 rubygems | 3.0.9.1, 2.2.8.1, 2.1.4.4, 2.0.9.4 | ||
 rpm rhel9 | 0:0.11.7-2.el9_4 | ||
rpm rhel9.2 | 0:0.11.4-7.el9_2.1 | ||
rpm rhel7 | - | - | |
rpm rhel8 | 0:0.10.18-2.el8_10 | ||
rpm rhel8.6 | 0:0.10.12-6.el8_6.5 |
1-10 of 12
10
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5. 6. 7.