CVE-2013-0184: Medium severity rack-project rack vulnerability
A flaw that was fixed in 1.4.4, 1.3.9, 1.2.7, and 1.1.5 was also announced [4] that creates a minor denial of service condition, this time in the Rack::Auth::AbstractRequest, where it symbolized arbitrary strings (apparently this has something to do with authentication, but there is no further information provided other than the fix [5] itself, which is noted as "a breaking API change").
[4] https://groups.google.com/forum/#!topic/rack-devel/ImYOqcGiksw/discussion [5] https://github.com/rack/rack/commit/0c76175fcccad74ba2f991c487d3669c28a297c8
Other sources
Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0184?
CVE-2013-0184 has a minor severity level as it creates a limited denial of service situation.
How do I fix CVE-2013-0184?
To fix CVE-2013-0184, upgrade to Rack versions 1.4.4, 1.3.9, 1.2.7, or 1.1.5 or later.
Which versions of Rack are affected by CVE-2013-0184?
CVE-2013-0184 affects Rack versions 1.1.0 through 1.4.3.
What does CVE-2013-0184 impact in Rack?
CVE-2013-0184 impacts the Rack::Auth::AbstractRequest component, where it can symbolize arbitrary strings.
Was CVE-2013-0184 disclosed publicly?
Yes, CVE-2013-0184 was publicly announced and documented in various security advisories.