gsd-2022-44572
Vulnerability from gsd
Modified
2023-01-18 00:00
Details
There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572. Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1 # Impact Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. # Workarounds There are no feasible workarounds for this issue.
Aliases
Aliases
CVE-2022-44572


To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-44572",
    "description": "A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.",
    "id": "GSD-2022-44572",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-44572.html",
      "https://ubuntu.com/security/CVE-2022-44572"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "rack",
            "purl": "pkg:gem/rack"
          }
        }
      ],
      "aliases": [
        "CVE-2022-44572",
        "GHSA-rqv2-275x-2jq5"
      ],
      "details": "There is a denial of service vulnerability in the multipart parsing component\nof Rack. This vulnerability has been assigned the CVE identifier\nCVE-2022-44572.\n\nVersions Affected: \u003e= 2.0.0\nNot affected: None.\nFixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1\n\n# Impact\n\nCarefully crafted input can cause RFC2183 multipart boundary parsing in Rack\nto take an unexpected amount of time, possibly resulting in a denial of\nservice attack vector. Any applications that parse multipart posts using\nRack (virtually all Rails applications) are impacted.\n\n# Workarounds\n\nThere are no feasible workarounds for this issue.\n",
      "id": "GSD-2022-44572",
      "modified": "2023-01-18T00:00:00.000Z",
      "published": "2023-01-18T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/rack/rack/releases/tag/v3.0.4.1"
        }
      ],
      "schema_version": "1.4.0",
      "summary": "Denial of service via multipart parsing in Rack"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2022-44572",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "https://github.com/rack/rack",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Denial of Service (CWE-400)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://hackerone.com/reports/1639882",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/1639882"
          },
          {
            "name": "DSA-5530",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2023/dsa-5530"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20231208-0014/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20231208-0014/"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2022-44572",
      "date": "2023-01-18",
      "description": "There is a denial of service vulnerability in the multipart parsing component\nof Rack. This vulnerability has been assigned the CVE identifier\nCVE-2022-44572.\n\nVersions Affected: \u003e= 2.0.0\nNot affected: None.\nFixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1\n\n# Impact\n\nCarefully crafted input can cause RFC2183 multipart boundary parsing in Rack\nto take an unexpected amount of time, possibly resulting in a denial of\nservice attack vector. Any applications that parse multipart posts using\nRack (virtually all Rails applications) are impacted.\n\n# Workarounds\n\nThere are no feasible workarounds for this issue.\n",
      "gem": "rack",
      "ghsa": "rqv2-275x-2jq5",
      "patched_versions": [
        "~\u003e 2.0.9, \u003e= 2.0.9.2",
        "~\u003e 2.1.4, \u003e= 2.1.4.2",
        "~\u003e 2.2.6, \u003e= 2.2.6.1",
        "\u003e= 3.0.4.1"
      ],
      "title": "Denial of service via multipart parsing in Rack",
      "url": "https://github.com/rack/rack/releases/tag/v3.0.4.1"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c2.0.9.2||\u003e=2.1.0 \u003c2.1.4.2||\u003e=2.2.0 \u003c2.2.4.1",
          "affected_versions": "All versions before 2.0.9.2, all versions starting from 2.1.0 before 2.1.4.2, all versions starting from 2.2.0 before 2.2.4.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-1333",
            "CWE-937"
          ],
          "date": "2023-02-17",
          "description": "A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.",
          "fixed_versions": [
            "2.0.9.2",
            "2.1.4.2",
            "2.2.5"
          ],
          "identifier": "CVE-2022-44572",
          "identifiers": [
            "CVE-2022-44572",
            "GHSA-rqv2-275x-2jq5",
            "GMS-2023-66"
          ],
          "not_impacted": "All versions starting from 2.0.9.2 before 2.1.0, all versions starting from 2.1.4.2 before 2.2.0, all versions starting from 2.2.4.1",
          "package_slug": "gem/rack",
          "pubdate": "2023-02-09",
          "solution": "Upgrade to versions 2.0.9.2, 2.1.4.2, 2.2.5 or above.",
          "title": "Inefficient Regular Expression Complexity",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-44572",
            "https://hackerone.com/reports/1639882",
            "https://github.com/rack/rack/releases/tag/v3.0.4.1",
            "https://github.com/advisories/GHSA-rqv2-275x-2jq5"
          ],
          "uuid": "54175f1a-6fd6-40bb-9983-481bed1b53af"
        },
        {
          "affected_range": "\u003c0",
          "affected_versions": "All versions starting from 2.0.0 before 2.0.9.2, all versions starting from 2.1.0.0 before 2.1.4.2, all versions starting from 2.2.0.0 before 2.2.6.1, all versions starting from 3.0.0.0 before 3.0.4.1",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2023-01-18",
          "description": "There is a denial of service vulnerability in the multipart parsing component of Rack. Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.",
          "fixed_versions": [
            "2.0.9.2",
            "2.1.4.2",
            "2.2.6.1",
            "3.0.4.1"
          ],
          "identifier": "GMS-2023-66",
          "identifiers": [
            "GHSA-rqv2-275x-2jq5",
            "GMS-2023-66",
            "CVE-2022-44572"
          ],
          "not_impacted": "All versions before 2.0.0, all versions starting from 2.0.9.2 before 2.1.0.0, all versions starting from 2.1.4.2 before 2.2.0.0, all versions starting from 2.2.6.1 before 3.0.0.0, all versions starting from 3.0.4.1",
          "package_slug": "gem/rack",
          "pubdate": "2023-01-18",
          "solution": "Upgrade to versions 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1 or above.",
          "title": "Duplicate of ./gem/rack/CVE-2022-44572.yml",
          "urls": [
            "https://github.com/rack/rack/releases/tag/v3.0.4.1",
            "https://github.com/advisories/GHSA-rqv2-275x-2jq5"
          ],
          "uuid": "5c1e5904-6d5a-475e-8b5e-2d40f5f1be1a"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rack_project:rack:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.2.4.1",
                "versionStartIncluding": "2.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rack_project:rack:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.1.4.2",
                "versionStartIncluding": "2.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rack_project:rack:*:*:*:*:*:ruby:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.0.9.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2022-44572"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-1333"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/1639882",
              "refsource": "MISC",
              "tags": [
                "Permissions Required",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/1639882"
            },
            {
              "name": "DSA-5530",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "https://www.debian.org/security/2023/dsa-5530"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20231208-0014/",
              "refsource": "",
              "tags": [],
              "url": "https://security.netapp.com/advisory/ntap-20231208-0014/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-12-08T22:15Z",
      "publishedDate": "2023-02-09T20:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.