CVE-2022-30122
05.12.2022, 22:15
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.Enginsight
| Vendor | Product | Version |
|---|---|---|
| rack_project | rack | 1.2 ≤ 𝑥 < 2.0.9.1 |
| rack_project | rack | 2.1.0 ≤ 𝑥 < 2.1.4.1 |
| rack_project | rack | 2.2.0 ≤ 𝑥 < 2.2.3.1 |
| debian | debian_linux | 11.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ruby-rack |
|
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-1333 - Inefficient Regular Expression ComplexityThe product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
References