Bug 2176477 (CVE-2023-27530)
| Summary: | CVE-2023-27530 rubygem-rack: Denial of service in Multipart MIME parsing | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | amackenz, amasferr, bbuckingham, bcourt, cfeist, chazlett, cluster-maint, ehelms, idevat, jcantril, jsherril, lzap, mhulan, mkudlej, mlisik, mpospisi, myarboro, nmoumoul, omular, orabin, pcreech, periklis, rchan, tjochec, tojeline |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | rubygem-rack 3.0.4.2, rubygem-rack 2.2.6.3, rubygem-rack 2.1.4.3, rubygem-rack 2.0.9.3 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in rubygem-rack. This issue occurs in the Multipart MIME parsing code in Rack, which limits the number of file parts but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected, resulting in a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-31 21:12:18 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2176478, 2176479, 2178351, 2178700, 2178701, 2179845, 2180708, 2180709, 2180710, 2180713, 2180714, 2180715, 2180716 | ||
| Bug Blocks: | 2176480 | ||
|
Description
Pedro Sampaio
2023-03-08 13:34:53 UTC
Created rubygem-rack tracking bugs for this issue: Affects: fedora-all [bug 2176478] Created rubygem-rack tracking bugs for this issue: Affects: epel-all [bug 2176479] This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2023:1961 https://access.redhat.com/errata/RHSA-2023:1961 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:1981 https://access.redhat.com/errata/RHSA-2023:1981 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:2652 https://access.redhat.com/errata/RHSA-2023:2652 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:3082 https://access.redhat.com/errata/RHSA-2023:3082 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:3403 https://access.redhat.com/errata/RHSA-2023:3403 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2023-27530 This issue has been addressed in the following products: Red Hat Satellite 6.14 for RHEL 8 Via RHSA-2023:6818 https://access.redhat.com/errata/RHSA-2023:6818 |