CVE-2022-44570
09.02.2023, 20:15
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.Enginsight
| Vendor | Product | Version |
|---|---|---|
| rack | rack | 1.5.0 ≤ 𝑥 < 2.0.9.2 |
| rack | rack | 2.1.0 ≤ 𝑥 < 2.1.4.2 |
| rack | rack | 2.2.0 ≤ 𝑥 < 2.2.6.1 |
| rack | rack | 3.0.0 ≤ 𝑥 < 3.0.4.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ruby-rack |
|
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-1333 - Inefficient Regular Expression ComplexityThe product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
References