CVE-2024-26146

Rack es una interfaz modular de servidor web Ruby. Los encabezados cuidadosamente elaborados pueden hacer que el análisis de encabezados en Rack demore más de lo esperado, lo que resulta en un posible problema de denegación de servicio. Los encabezados Aceptar y Reenviar se ven afectados. Ruby 3.2 tiene mitigaciones para este problema, por lo que las aplicaciones Rack que usan Ruby 3.2 o posterior no se ven afectadas. Esta vulnerabilidad se solucionó en 2.0.9.4, 2.1.4.4, 2.2.8.1 y 3.0.9.1.

A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Rack Header. Carefully crafted headers can cause header parsing in Rack to take longer than expected, resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

It was discovered that Rack was not properly parsing data when processing multipart POST requests. If a user or automated system were tricked into sending a specially crafted multipart POST request to an application using Rack, a remote attacker could possibly use this issue to cause a denial of service. It was discovered that Rack was not properly escaping untrusted data when performing logging operations, which could cause shell escaped sequences to be written to a terminal. If a user or automated system were tricked into sending a specially crafted request to an application using Rack, a remote attacker could possibly use this issue to execute arbitrary code in the machine running the application.