Fluid Attacks Database

Description

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	ruby-rack	=2.1.4-3 \|\| >=0 <2.1.4-3+deb11u1	2.1.4-3+deb11u1
debian 12	ruby-rack	>=0 <2.2.4-3	2.2.4-3
debian 13	ruby-rack	>=0 <2.2.4-3	2.2.4-3
debian 14	ruby-rack	>=0 <2.2.4-3	2.2.4-3
rubygems	rack	>=1.5.0 <2.0.9.2 \|\| >=2.1.0.0 <2.1.4.2 \|\| >=2.2.0.0 <2.2.6.2 \|\| >=3.0.0.0 <3.0.4.1	2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.4.1

Aliases

1. CVE-2022-445702. NVD-2022-445703. OSV-DEBIAN-2022-445704. OSV-2022-445705. GCVE-2022-445706. SECURITY-TRACKER-CVE-2022-44570

References

1. https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/821252. https://github.com/rack/rack/releases/tag/v3.0.4.13. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-44570.yml4. https://security.netapp.com/advisory/ntap-20231208-00105. https://www.debian.org/security/2023/dsa-5530

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.