USN-6837-1: Rack vulnerabilities
17 June 2024
Several security issues were fixed in Rack.
Releases
Packages
- ruby-rack - modular Ruby webserver interface
Details
It was discovered that Rack incorrectly handled Multipart MIME parsing. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected Ubuntu
23.10. (CVE-2023-27530)
It was discovered that Rack incorrectly parsed certain media types. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. (CVE-2024-25126)
It was discovered that Rack incorrectly handled certain Range headers. A
remote attacker could possibly use this issue to cause Rack to create large
responses, leading to a denial of service. This issue only affected Ubuntu
24.04 LTS. (CVE-2024-26141)
It was discovered that Rack incorrectly handled certain crafted headers. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected Ubuntu
24.04 LTS. (CVE-2024-26146)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 24.04
Ubuntu 23.10
After a standard system update you need to restart any applications using
Rack to make all the necessary changes.
References
Related notices
- USN-6837-2: librack-ruby, librack-ruby1.9.1, ruby-rack, librack-ruby1.8
- USN-7036-1: ruby-rack
- USN-6689-1: ruby-rack
- USN-6905-1: librack-ruby, librack-ruby1.9.1, ruby-rack, librack-ruby1.8