Bugzilla – Bug 1200748
VUL-0: CVE-2022-30122: rubygem-rack: crafted multipart POST request may cause a DoS
Last modified: 2022-12-20 11:13:34 UTC
rh#2099519 Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability. Reference: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30122.yml References: https://bugzilla.redhat.com/show_bug.cgi?id=2099519 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-30122
Fix: https://github.com/rack/rack/commit/d286516cbd58fbb2ad6944ce9040e9ba96d9371a Affected: - SUSE:SLE-12:Update/rubygem-rack 1.6.13 - SUSE:SLE-15:Update/rubygem-rack 2.0.8 Not Affected: - openSUSE:Factory/rubygem-rack 2.2.3.1
Submitted for 15,12/rubygem-rack. Please review very carefully. Also, review of one or more of previous maintainers/contributors would be more than welcome.
Requests were accepted.
SUSE-SU-2022:2192-1: An update that fixes two vulnerabilities is now available. Category: security (critical) Bug References: 1200748,1200750 CVE References: CVE-2022-30122,CVE-2022-30123 JIRA References: Sources used: openSUSE Leap 15.4 (src): rubygem-rack-2.0.8-150000.3.6.1 openSUSE Leap 15.3 (src): rubygem-rack-2.0.8-150000.3.6.1 SUSE Linux Enterprise High Availability 15-SP4 (src): rubygem-rack-2.0.8-150000.3.6.1 SUSE Linux Enterprise High Availability 15-SP3 (src): rubygem-rack-2.0.8-150000.3.6.1 SUSE Linux Enterprise High Availability 15-SP2 (src): rubygem-rack-2.0.8-150000.3.6.1 SUSE Linux Enterprise High Availability 15-SP1 (src): rubygem-rack-2.0.8-150000.3.6.1 SUSE Linux Enterprise High Availability 15 (src): rubygem-rack-2.0.8-150000.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2526-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (critical) Bug References: 1200748,1200750,1201588 CVE References: CVE-2022-30122,CVE-2022-30123 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): rubygem-rack-1.6.13-3.13.1 SUSE OpenStack Cloud Crowbar 8 (src): rubygem-rack-1.6.13-3.13.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done