Carefully crafted requests can cause shell escape sequences to be written to the terminal via Rack's Lint middleware and CommonLogger middleware. These escape sequences can be leveraged to possibly execute commands in the victim's terminal. Reference: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30123.yml
Created rubygem-rack tracking bugs for this issue: Affects: epel-all [bug 2099525]
> Fixed In Version: rubygem-rack 2.0.9.1, rubygem-rack 2.1.4.1, rubygem-rack 2.2.3.1 Seeing the rack gem, All the Fedoras (37, 36, 35), and EPEL 9, 8 are also affected. Not sure for the EPEL 7. https://rubygems.org/gems/rack https://src.fedoraproject.org/rpms/rubygem-rack Fedora 37 rubygem-rack-2.2.3-8.fc37 Fedora 36 rubygem-rack-2.2.3-8.fc36 Fedora 35 rubygem-rack-2.2.3-6.fc35 Fedora EPEL 9 rubygem-rack-2.2.3-8.el9 Fedora EPEL 8 rubygem-rack-2.2.2-1.el8 Fedora EPEL 7 rubygem-rack-1.6.12-1.el7 => affected?
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2022:7343 https://access.redhat.com/errata/RHSA-2022:7343
Hi, An OpenStack customer is asking if this is going to make it somehow in RHOSP 13. Is this fix needed for OpenStack? What impact does this issue have in OpenStack if any? Thank you!
(In reply to Jun Aruga from comment #3) > > Fixed In Version: rubygem-rack 2.0.9.1, rubygem-rack 2.1.4.1, rubygem-rack 2.2.3.1 > > Seeing the rack gem, All the Fedoras (37, 36, 35), and EPEL 9, 8 are also > affected. Not sure for the EPEL 7. > https://rubygems.org/gems/rack > > https://src.fedoraproject.org/rpms/rubygem-rack > Fedora 37 rubygem-rack-2.2.3-8.fc37 > Fedora 36 rubygem-rack-2.2.3-8.fc36 > Fedora 35 rubygem-rack-2.2.3-6.fc35 > Fedora EPEL 9 rubygem-rack-2.2.3-8.el9 > Fedora EPEL 8 rubygem-rack-2.2.2-1.el8 > Fedora EPEL 7 rubygem-rack-1.6.12-1.el7 => affected? Sorry my mistake. It seems that it was already fixed in the Fedoras and EPEL 9, by rubygem-rack 2.2.3.
This issue has been addressed in the following products: Logging subsystem for Red Hat OpenShift 5.4 Via RHSA-2023:0632 https://access.redhat.com/errata/RHSA-2023:0632
This issue has been addressed in the following products: Red Hat Gluster Storage 3.5 for RHEL 7 Via RHSA-2023:1486 https://access.redhat.com/errata/RHSA-2023:1486
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-30123