Bug 2176477 (CVE-2023-27530) - CVE-2023-27530 rubygem-rack: Denial of service in Multipart MIME parsing
Summary: CVE-2023-27530 rubygem-rack: Denial of service in Multipart MIME parsing
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-27530
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2176478 2176479 2178351 2178700 2178701 2179845 2180708 2180709 2180710 2180713 2180714 2180715 2180716
Blocks: 2176480
TreeView+ depends on / blocked
 
Reported: 2023-03-08 13:34 UTC by Pedro Sampaio
Modified: 2023-11-08 14:17 UTC (History)
25 users (show)

Fixed In Version: rubygem-rack 3.0.4.2, rubygem-rack 2.2.6.3, rubygem-rack 2.1.4.3, rubygem-rack 2.0.9.3
Clone Of:
Environment:
Last Closed: 2023-05-31 21:12:18 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:1961 0 None None None 2023-04-25 08:29:18 UTC
Red Hat Product Errata RHSA-2023:1981 0 None None None 2023-04-25 10:21:24 UTC
Red Hat Product Errata RHSA-2023:2652 0 None None None 2023-05-09 11:35:38 UTC
Red Hat Product Errata RHSA-2023:3082 0 None None None 2023-05-16 09:59:05 UTC
Red Hat Product Errata RHSA-2023:3403 0 None None None 2023-05-31 15:44:51 UTC
Red Hat Product Errata RHSA-2023:6818 0 None None None 2023-11-08 14:17:21 UTC

Description Pedro Sampaio 2023-03-08 13:34:53 UTC 
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

# Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.

References:

https://github.com/rubysec/ruby-advisory-db/tree/master/gems/rack/CVE-2023-27530.yml
Comment 1 Pedro Sampaio 2023-03-08 13:35:10 UTC 
Created rubygem-rack tracking bugs for this issue:

Affects: fedora-all [bug 2176478]
Comment 2 Pedro Sampaio 2023-03-08 13:36:59 UTC 
Created rubygem-rack tracking bugs for this issue:

Affects: epel-all [bug 2176479]
Comment 9 errata-xmlrpc 2023-04-25 08:29:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1961 https://access.redhat.com/errata/RHSA-2023:1961
Comment 10 errata-xmlrpc 2023-04-25 10:21:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:1981 https://access.redhat.com/errata/RHSA-2023:1981
Comment 11 errata-xmlrpc 2023-05-09 11:35:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2652 https://access.redhat.com/errata/RHSA-2023:2652
Comment 12 errata-xmlrpc 2023-05-16 09:59:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3082 https://access.redhat.com/errata/RHSA-2023:3082
Comment 13 errata-xmlrpc 2023-05-31 15:44:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:3403 https://access.redhat.com/errata/RHSA-2023:3403
Comment 14 Product Security DevOps Team 2023-05-31 21:12:14 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-27530
Comment 15 errata-xmlrpc 2023-11-08 14:17:19 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.14 for RHEL 8

Via RHSA-2023:6818 https://access.redhat.com/errata/RHSA-2023:6818
Note You need to log in before you can comment on or make changes to this bug.