CVE-2024-25126
Published: 29 February 2024
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
Priority
Status
Package | Release | Status |
---|---|---|
ruby-rack Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Needs triage
|
|
jammy |
Needs triage
|
|
mantic |
Released
(2.2.4-3ubuntu0.2)
|
|
noble |
Released
(2.2.7-1ubuntu0.1)
|
|
trusty |
Needs triage
|
|
upstream |
Released
(2.2.8.1,2.2.7-1.1)
|
|
xenial |
Needs triage
|
|
Patches: upstream: https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49 |