Bug 1646814 (CVE-2018-16470)

Summary:	CVE-2018-16470 rubygem-rack: Buffer size in multipart parser allows for denial of service
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, apevec, bbuckingham, bcourt, bkearney, bleanhar, bmidwood, cbillett, ccoleman, chrisw, dajohnso, dbecker, dclarizi, dedgar, dmetzger, dmoppert, eparis, gblomqui, gmccullo, gtanzill, hhorak, jaruga, jfrey, jgoulding, jhardy, jjoyce, jokerman, jorton, jpadman, jprause, jschluet, kbasil, kdixon, lavenel, lhh, lpeer, markmc, mburns, mchappel, mmccune, mo, mzalewsk, obarenbo, ohadlevy, rbryant, rchan, rhos-maint, rjerrido, roliveri, ruby-maint, sclewis, security-response-team, simaishi, sisharma, slinaber, steve.traylen, strzibny, tdecacqu, tomckay, vbellur, vondruch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rubygem-rack 2.0.6	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-10-22 18:51:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1646815, 1663573, 1666066, 1666067, 1666068, 1748337, 1748339
Bug Blocks:	1646821

Description Sam Fowler 2018-11-06 04:31:50 UTC

Rack (rubygem-rack) versions 2.04 and 2.0.5 are vulnerable to a denial of service due to incorrect buffer size in the multipart parser. Carefully crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.


External Reference:

https://groups.google.com/forum/#!msg/rubyonrails-security/U_x-YkfuVTg/xhvYAmp6AAAJ

Comment 1 Sam Fowler 2018-11-06 04:32:06 UTC

Created rubygem-rack tracking bugs for this issue:

Affects: fedora-all [bug 1646815]

Comment 2 James Hebden 2018-11-28 04:48:23 UTC

rubygem-rack as shipped by OpenShift Enterprise 3.1 through 3.4 is version 1.5.2, which is not impacted. Version 1.5.2 does not contain the problematic commit which is reverted by the patch to address this flaw.

Comment 3 James Hebden 2018-11-29 06:27:52 UTC

rubygem-rack as shipped by OpenShift Enterprise 3.1 through 3.4 is version 1.5.2, which is not impacted. Version 1.5.2 does not contain the problematic commit which is reverted by the patch to address this flaw.

Comment 6 Riccardo Schirone 2018-12-12 12:13:32 UTC

Upstream patch on 2.0-stable branch:
https://github.com/rack/rack/commit/37c1160b2360074d20858792f23a7eb3afeabebd

Comment 14 Richard Maciel Costa 2019-01-17 15:41:01 UTC

Statement:

OpenShift Enterprise and Red Hat OpenStack Platform optools both ship rubygem-rack 1.5.2, which is not affected by this flaw.

Red Hat Subscription Asset Manager uses rubygem-rack 1.4.5, and is not affected by this flaw.

Red Hat Update Infrastructure ships rubygem-rack version 1.4.2, which is not affected by this flaw.

Red Hat CloudForms versions 4.5 and 4.6 ship rack version 2.0.3, which is not affected by this flaw; while Red Hat CloudForms version 4.7 ships rack version 2.0.6,  which already contains the fix for this flaw.

Comment 19 errata-xmlrpc 2019-10-22 12:46:31 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.6 for RHEL 7

Via RHSA-2019:3172 https://access.redhat.com/errata/RHSA-2019:3172

Comment 20 Product Security DevOps Team 2019-10-22 18:51:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-16470

Comment 21 Yadnyawalk Tale 2020-04-20 10:29:04 UTC

Satellite 6.7 contains tfm-ror52-rubygem-rack-2.0.6-1 and hence not vulnerable to this old flaw.