UBUNTU-CVE-2022-44570
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
02 / AFFECTED SOFTWARE
Affected packages
4 explicit affected versions
5 explicit affected versions
7 explicit affected versions
5 explicit affected versions
5 explicit affected versions
5 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
05 / REFERENCES
Further evidence
- https://github.com/rack/rack/commit/52721ae0b730e3920ad5375dfd5a3ea9b4f9e359
- https://github.com/rack/rack/commit/f66ef5c8255dcea82c1b2665fc9ab948b76bb437
- https://github.com/rack/rack/commit/f6d4f528f2df1318a6612845db0b59adc7fe8fc1
- https://ubuntu.com/security/CVE-2022-44570
- https://ubuntu.com/security/notices/USN-5910-1
- https://ubuntu.com/security/notices/USN-7036-1
- https://www.cve.org/CVERecord?id=CVE-2022-44570