CVE-2022-44570
published 2023-02-09CVE-2022-44570: A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.63%
73.7th percentile
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-rack | < ruby-rack 2.2.4-3 (bookworm) | ruby-rack 2.2.4-3 (bookworm) |
| https | github.com_rack_rack | — | — |
| rack | rack | >= 1.5.0 < 2.0.9.2 | 2.0.9.2 |
| rack | rack | >= 1.5.0 < 2.0.9.2 | 2.0.9.2 |
| rack | rack | >= 2.1.0 < 2.1.4.2 | 2.1.4.2 |
| rack | rack | >= 2.1.0.0 < 2.1.4.2 | 2.1.4.2 |
| rack | rack | >= 2.2.0 < 2.2.6.1 | 2.2.6.1 |
| rack | rack | >= 2.2.0.0 < 2.2.6.2 | 2.2.6.2 |
| rack | rack | >= 3.0.0 < 3.0.4.1 | 3.0.4.1 |
| rack | rack | >= 3.0.0.0 < 3.0.4.1 | 3.0.4.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2024-09-26·CVSS 7.5
CVE-2024-25126 [HIGH] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
It was discovered that Rack was not properly parsing data when processing
multipart POST requests. If a user or automated system were tricked into
sending a specially crafted multipart POST request to an application using
Rack, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2022-30122)
It was discovered that Rack was not properly escaping untrusted data when
performing logging operations, which could cause shell escaped sequences
to be written to a terminal. If a user or automated system were tricked
into sending a specially crafted request to an application using Rack, a
remote attacker could possibly use this issue to execute arbitrary code in
the machine running the ap
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2023-03-02·CVSS 7.5
CVE-2022-44571 [HIGH] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
It was discovered that Rack did not properly structure regular expressions
in some of its parsing components, which could result in uncontrolled
resource consumption if an application using Rack received specially
crafted input. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-44570, CVE-2022-44571)
It was discovered that Rack did not properly structure regular expressions
in its multipart parsing component, which could result in uncontrolled
resource consumption if an application using Rack to parse multipart posts
received specially crafted input. A remote attacker could possibly use
this issue to cause a denial of service. This issue was only fixed in
Ubuntu 20.04 E
Red Hat
rubygem-rack: denial of service in Content-Disposition parsing
vendor_redhat·2023-01-20·CVSS 7.5
CVE-2022-44570 [HIGH] CWE-1333 rubygem-rack: denial of service in Content-Disposition parsing
rubygem-rack: denial of service in Content-Disposition parsing
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
A flaw was found in rubygem-rack. Rack is vulnerable to a denial of service caused by a regular expression denial of service (ReDoS) flaw in the Rack::Utils.get_byte_ranges function. By sending a specially-crafted regex input, a remote attacker can cause a denial of service.
Debian
CVE-2022-44570: ruby-rack - A denial of service vulnerability in the Range header parsing component of Rack ...
vendor_debian·2022·CVSS 7.5
CVE-2022-44570 [HIGH] CVE-2022-44570: ruby-rack - A denial of service vulnerability in the Range header parsing component of Rack ...
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
Scope: local
bookworm: resolved (fixed in 2.2.4-3)
bullseye: resolved (fixed in 2.1.4-3+deb11u1)
forky: resolved (fixed in 2.2.4-3)
sid: resolved (fixed in 2.2.4-3)
trixie: resolved (fixed in 2.2.4-3)
OSV
ruby-rack vulnerabilities
osv·2024-09-26·CVSS 7.5
CVE-2022-30122 [HIGH] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack was not properly parsing data when processing
multipart POST requests. If a user or automated system were tricked into
sending a specially crafted multipart POST request to an application using
Rack, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2022-30122)
It was discovered that Rack was not properly escaping untrusted data when
performing logging operations, which could cause shell escaped sequences
to be written to a terminal. If a user or automated system were tricked
into sending a specially crafted request to an application using Rack, a
remote attacker could possibly use this issue to execute arbitrary code in
the machine running the application. (CVE-2022-30123)
It was discovered that Rack
OSV
ruby-rack vulnerabilities
osv·2023-03-02·CVSS 7.5
CVE-2022-44570 [HIGH] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack did not properly structure regular expressions
in some of its parsing components, which could result in uncontrolled
resource consumption if an application using Rack received specially
crafted input. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-44570, CVE-2022-44571)
It was discovered that Rack did not properly structure regular expressions
in its multipart parsing component, which could result in uncontrolled
resource consumption if an application using Rack to parse multipart posts
received specially crafted input. A remote attacker could possibly use
this issue to cause a denial of service. This issue was only fixed in
Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2022-44572)
OSV
CVE-2022-44570: A denial of service vulnerability in the Range header parsing component of Rack >= 1
osv·2023-02-09·CVSS 7.5
CVE-2022-44570 [HIGH] CVE-2022-44570: A denial of service vulnerability in the Range header parsing component of Rack >= 1
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
GHSA
Denial of service via header parsing in Rack
ghsa·2023-01-18·CVSS 7.5
CVE-2022-44570 [HIGH] CWE-1333 Denial of service via header parsing in Rack
Denial of service via header parsing in Rack
There is a possible denial of service vulnerability in the Range header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44570.
Versions Affected: >= 1.5.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.0.1
Impact
Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren’t able to
OSV
Denial of service via header parsing in Rack
osv·2023-01-18·CVSS 7.5
CVE-2022-44570 [HIGH] Denial of service via header parsing in Rack
Denial of service via header parsing in Rack
There is a possible denial of service vulnerability in the Range header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44570.
Versions Affected: >= 1.5.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.0.1
Impact
Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren’t able to
No detection rules found.
No public exploits indexed.
https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125https://security.netapp.com/advisory/ntap-20231208-0010/https://www.debian.org/security/2023/dsa-5530https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125https://security.netapp.com/advisory/ntap-20231208-0010/https://www.debian.org/security/2023/dsa-5530
2023-02-09
Published