Vulnerability · Published Feb 28, 2024 · Assigned by GitHub_M
CVE-2024-25126Rack ReDos in content type parsing (2nd degree polynomial)
Medium 5.3
In plain English
A medium-severity regular-expression denial of service in rack from rack. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 35.4% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)35.4%top 1.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pcs | 0.10.18-2.el8_10 | ALSA-2024:2953 |
| AlmaLinux:9 | pcs | 0.11.7-2.el9_4 | ALSA-2024:2113 |
| AlmaLinux:8 | pcs-snmp | 0.10.18-2.el8_10 | ALSA-2024:2953 |
| AlmaLinux:9 | pcs-snmp | 0.11.7-2.el9_4 | ALSA-2024:2113 |
| Debian:12 | ruby-rack | 2.2.6.4-1+deb12u1 | DSA-5698-1 |
| Debian:12 | ruby-rack | 2.2.6.4-1+deb12u1 | DEBIAN-CVE-2024-25126 |
| Debian:13 | ruby-rack | 2.2.7-1.1 | DEBIAN-CVE-2024-25126 |
| Debian:14 | ruby-rack | 2.2.7-1.1 | DEBIAN-CVE-2024-25126 |
| Rocky Linux:8 | pcs | 0:0.10.18-2.el8_10 | RLSA-2024:2953 |
| RubyGems | rack | 2.2.8.1 | GHSA-22f2-v57c-j9cx |
| RubyGems | rack | 3.0.9.1 | GHSA-22f2-v57c-j9cx |
| Ubuntu:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.1 | UBUNTU-CVE-2024-25126 |
| Ubuntu:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.1 | USN-7036-1 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.1 | USN-6837-1 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.1 | UBUNTU-CVE-2024-25126 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx x_refsource_CONFIRM
- https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462 x_refsource_MISC
- https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49 x_refsource_MISC
- https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941 x_refsource_MISC
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
- https://security.netapp.com/advisory/ntap-20240510-0005/