CVE-2022-44572
rubygem-rack: denial of service in Content-Disposition parsing
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
A flaw was found in rubygem-rack. Rack is vulnerable to a denial of service caused by a regular expression denial of service (ReDoS) flaw in the multipart parsing component. By sending a specially-crafted input, a remote attacker can cause a denial of service.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-11-01 CVE Reserved
- 2023-02-09 CVE Published
- 2024-08-03 CVE Updated
- 2024-09-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-1333: Inefficient Regular Expression Complexity
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20231208-0014 |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2023/dsa-5530 | 2023-12-08 | |
| https://access.redhat.com/security/cve/CVE-2022-44572 | 2023-11-08 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2164722 | 2023-11-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | < 2.0.9.2 Search vendor "Rack Project" for product "Rack" and version " < 2.0.9.2" | ruby |
Affected
| ||||||
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | >= 2.1.0 < 2.1.4.2 Search vendor "Rack Project" for product "Rack" and version " >= 2.1.0 < 2.1.4.2" | ruby |
Affected
| ||||||
| Rack Project Search vendor "Rack Project" | Rack Search vendor "Rack Project" for product "Rack" | >= 2.2.0 < 2.2.4.1 Search vendor "Rack Project" for product "Rack" and version " >= 2.2.0 < 2.2.4.1" | ruby |
Affected
| ||||||