CVE-2018-16470: High severity rack-project rack vulnerability
Published Nov 6, 2018
·Updated
Rack (rubygem-rack) versions 2.04 and 2.0.5 are vulnerable to a denial of service due to incorrect buffer size in the multipart parser. Carefully crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
External Reference:
https://groups.google.com/forum/#!msg/rubyonrails-security/Ux-YkfuVTg/xhvYAmp6AAAJ
Other sources
There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
Affected Software
277 affected componentsFixes available
redhat/ansiblerole-insights-client<0:1.6-2.el7
0:1.6-2.el7
redhat/ansible-runner<0:1.3.4-2.el7a
0:1.3.4-2.el7a
redhat/candlepin<0:2.6.9-1.el7
0:2.6.9-1.el7
redhat/foreman<0:1.22.0.32-1.el7
0:1.22.0.32-1.el7
redhat/foreman-bootloaders-redhat<0:201901011200-1.el7
0:201901011200-1.el7
redhat/foreman-installer<1:1.22.0.16-1.el7
1:1.22.0.16-1.el7
redhat/foreman-proxy<0:1.22.0.2-1.el7
0:1.22.0.2-1.el7
redhat/foreman-selinux<0:1.22.0-1.el7
0:1.22.0-1.el7
redhat/future<0:0.16.0-11.el7
0:0.16.0-11.el7
redhat/gofer<0:2.12.5-5.el7
0:2.12.5-5.el7
redhat/hfsplus-tools<0:332.14-12.el7
0:332.14-12.el7
redhat/katello<0:3.12.0-2.el7
0:3.12.0-2.el7
redhat/katello-certs-tools<0:2.6.0-1.el7
0:2.6.0-1.el7
redhat/katello-client-bootstrap<0:1.7.3-1.el7
0:1.7.3-1.el7
redhat/katello-selinux<0:3.1.1-2.el7
0:3.1.1-2.el7
redhat/kobo<0:0.5.1-1.el7
0:0.5.1-1.el7
redhat/libmodulemd<0:1.7.0-1.pulp.el7
0:1.7.0-1.pulp.el7
redhat/libsolv<0:0.7.4-3.pulp.el7
0:0.7.4-3.pulp.el7
redhat/libwebsockets<0:2.4.2-2.el7
0:2.4.2-2.el7
redhat/livecd-tools<1:20.4-1.6.el7
1:20.4-1.6.el7
redhat/ostree<0:2017.1-2.atomic.el7
0:2017.1-2.atomic.el7
redhat/pcp-mmvstatsd<0:0.4-2.el7
0:0.4-2.el7
redhat/pulp<0:2.19.1.1-1.el7
0:2.19.1.1-1.el7
redhat/pulp-docker<0:3.2.3.1-2.el7
0:3.2.3.1-2.el7
redhat/pulp-katello<0:1.0.3-1.el7
0:1.0.3-1.el7
redhat/pulp-ostree<0:1.3.1-2.el7
0:1.3.1-2.el7
redhat/pulp-puppet<0:2.19.1-2.el7
0:2.19.1-2.el7
redhat/pulp-rpm<0:2.19.1.1-2.el7
0:2.19.1.1-2.el7
redhat/puppet-agent<0:5.5.12-1.el7
0:5.5.12-1.el7
redhat/puppet-agent-oauth<0:0.5.1-3.el7
0:0.5.1-3.el7
redhat/puppetlabs-stdlib<0:4.25.1-2.el7
0:4.25.1-2.el7
redhat/puppetserver<0:5.3.8-1.el7
0:5.3.8-1.el7
redhat/pycairo<0:1.16.3-9.el7
0:1.16.3-9.el7
redhat/pygobject3<0:3.28.3-2.el7
0:3.28.3-2.el7
redhat/python-amqp<0:2.2.2-5.el7
0:2.2.2-5.el7
redhat/python-anyjson<0:0.3.3-11.el7
0:0.3.3-11.el7
redhat/python-billiard<1:3.5.0.3-3.el7
1:3.5.0.3-3.el7
redhat/python-blinker<0:1.3-2.el7
0:1.3-2.el7
redhat/python-celery<0:4.0.2-9.el7
0:4.0.2-9.el7
redhat/python-click<0:6.7-9.el7
0:6.7-9.el7
redhat/python-crane<0:3.3.1-9.el7
0:3.3.1-9.el7
redhat/python-daemon<0:2.1.2-7.el7a
0:2.1.2-7.el7a
redhat/python-django<0:1.11.13-1.el7
0:1.11.13-1.el7
redhat/python-flask<1:0.12.2-4.el7
1:0.12.2-4.el7
redhat/python-gnupg<0:0.3.7-1.el7
0:0.3.7-1.el7
redhat/python-isodate<0:0.5.4-12.el7
0:0.5.4-12.el7
redhat/python-itsdangerous<0:0.24-15.el7
0:0.24-15.el7
redhat/python-jinja2<0:2.10-10.el7
0:2.10-10.el7
redhat/python-kid<0:0.9.6-11.el7
0:0.9.6-11.el7
redhat/python-kombu<10:4.0.2-13.el7
10:4.0.2-13.el7
redhat/python-lockfile<1:0.11.0-10.el7a
1:0.11.0-10.el7a
redhat/python-markupsafe<0:0.23-21.el7
0:0.23-21.el7
redhat/python-mongoengine<0:0.10.5-2.el7
0:0.10.5-2.el7
redhat/python-nectar<0:1.6.0-1.el7
0:1.6.0-1.el7
redhat/python-oauth2<0:1.5.211-8.el7
0:1.5.211-8.el7
redhat/python-okaara<0:1.0.37-2.el7
0:1.0.37-2.el7
redhat/python-pexpect<0:4.6-1.el7a
0:4.6-1.el7a
redhat/python-psutil<0:5.0.1-3.el7
0:5.0.1-3.el7
redhat/python-ptyprocess<0:0.5.2-3.el7a
0:0.5.2-3.el7a
redhat/python-pycurl<0:7.43.0.2-4.el7
0:7.43.0.2-4.el7
redhat/python-pymongo<0:3.2-2.el7
0:3.2-2.el7
redhat/python-qpid<0:1.35.0-5.el7
0:1.35.0-5.el7
redhat/python-simplejson<0:3.2.0-1.el7
0:3.2.0-1.el7
redhat/python-twisted<0:16.4.1-12.el7
0:16.4.1-12.el7
redhat/python-vine<10:1.1.3-6.el7
10:1.1.3-6.el7
redhat/python-werkzeug<0:0.12.2-5.el7
0:0.12.2-5.el7
redhat/python-zope-interface<0:4.0.5-4.el7
0:4.0.5-4.el7
redhat/qpid-cpp<0:1.36.0-28.el7a
0:1.36.0-28.el7a
redhat/qpid-dispatch<0:1.5.0-4.el7
0:1.5.0-4.el7
redhat/qpid-proton<0:0.28.0-1.el7
0:0.28.0-1.el7
redhat/redhat-access-insights-puppet<0:1.0.0-1.el7
0:1.0.0-1.el7
redhat/repoview<0:0.6.6-11.el7
0:0.6.6-11.el7
redhat/rhel8-kickstart-setup<0:0.0.2-1.el7
0:0.0.2-1.el7
redhat/rubygem-ansi<0:1.4.3-3.el7
0:1.4.3-3.el7
redhat/rubygem-clamp<0:1.1.2-2.el7
0:1.1.2-2.el7
redhat/rubygem-concurrent-ruby<1:1.1.4-2.el7
1:1.1.4-2.el7
redhat/rubygem-facter<0:2.4.1-2.el7
0:2.4.1-2.el7
redhat/rubygem-faraday<0:0.15.4-1.el7
0:0.15.4-1.el7
redhat/rubygem-ffi<0:1.4.0-3.el7
0:1.4.0-3.el7
redhat/rubygem-gssapi<0:1.1.2-4.el7
0:1.1.2-4.el7
redhat/rubygem-hashie<0:2.0.5-5.el7
0:2.0.5-5.el7
redhat/rubygem-highline<0:1.7.8-3.el7
0:1.7.8-3.el7
redhat/rubygem-infoblox<0:3.0.0-1.el7
0:3.0.0-1.el7
redhat/rubygem-journald-logger<0:2.0.4-2.el7
0:2.0.4-2.el7
redhat/rubygem-journald-native<0:1.0.11-2.el7
0:1.0.11-2.el7
redhat/rubygem-jwt<0:1.2.1-1.el7
0:1.2.1-1.el7
redhat/rubygem-kafo<0:3.0.0-1.el7
0:3.0.0-1.el7
redhat/rubygem-little-plugger<0:1.1.3-22.el7
0:1.1.3-22.el7
redhat/rubygem-logging<0:2.2.2-4.el7
0:2.2.2-4.el7
redhat/rubygem-logging-journald<0:2.0.0-2.el7
0:2.0.0-2.el7
redhat/rubygem-mime-types<0:1.19-7.el7
0:1.19-7.el7
redhat/rubygem-multipart-post<0:2.0.0-1.el7
0:2.0.0-1.el7
redhat/rubygem-netrc<0:0.7.7-9.el7
0:0.7.7-9.el7
redhat/rubygem-net-ssh<0:4.2.0-1.el7
0:4.2.0-1.el7
redhat/rubygem-newt<0:0.9.6-3.el7
0:0.9.6-3.el7
redhat/rubygem-oauth<0:0.5.4-2.el7
0:0.5.4-2.el7
redhat/rubygem-openscap<0:0.4.7-4.el7
0:0.4.7-4.el7
redhat/rubygem-passenger<0:4.0.18-24.el7
0:4.0.18-24.el7
redhat/rubygem-powerbar<0:2.0.1-2.el7
0:2.0.1-2.el7
redhat/rubygem-rack<1:1.6.4-3.el7
1:1.6.4-3.el7
redhat/rubygem-rack-protection<0:1.5.3-4.el7
0:1.5.3-4.el7
redhat/rubygem-rake<0:0.9.2.2-41.el7
0:0.9.2.2-41.el7
redhat/rubygem-rb-inotify<0:0.9.7-5.el7
0:0.9.7-5.el7
redhat/rubygem-rest-client<0:1.6.7-7.el7
0:1.6.7-7.el7
redhat/rubygem-rkerberos<0:0.1.5-15.el7
0:0.1.5-15.el7
redhat/rubygem-rsec<0:0.4.3-1.el7
0:0.4.3-1.el7
redhat/rubygem-rubyipmi<0:0.10.0-3.el7
0:0.10.0-3.el7
redhat/rubygem-sinatra<1:1.4.7-3.el7
1:1.4.7-3.el7
redhat/rubygem-tilt<0:1.3.7-2.git.0.3b416c9.el7
0:1.3.7-2.git.0.3b416c9.el7
redhat/saslwrapper<0:0.22-5.el7
0:0.22-5.el7
redhat/satellite<0:6.6.0-7.el7
0:6.6.0-7.el7
redhat/satellite-installer<0:6.6.0.21-1.el7
0:6.6.0.21-1.el7
redhat/tfm<0:5.0-7.el7
0:5.0-7.el7
redhat/tfm-ror52<0:1.0-4.el7
0:1.0-4.el7
redhat/tfm-ror52-rubygem-actioncable<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-actionmailer<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-actionpack<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-actionview<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-activejob<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-activemodel<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-activerecord<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-activestorage<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-activesupport<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-arel<0:9.0.0-1.el7
0:9.0.0-1.el7
redhat/tfm-ror52-rubygem-builder<0:3.2.3-1.el7
0:3.2.3-1.el7
redhat/tfm-ror52-rubygem-coffee-rails<0:4.2.2-1.el7
0:4.2.2-1.el7
redhat/tfm-ror52-rubygem-coffee-script<0:2.4.1-1.el7
0:2.4.1-1.el7
redhat/tfm-ror52-rubygem-coffee-script-source<0:1.12.2-1.el7
0:1.12.2-1.el7
redhat/tfm-ror52-rubygem-concurrent-ruby<0:1.1.4-1.el7
0:1.1.4-1.el7
redhat/tfm-ror52-rubygem-crass<0:1.0.4-1.el7
0:1.0.4-1.el7
redhat/tfm-ror52-rubygem-erubi<0:1.7.1-1.el7
0:1.7.1-1.el7
redhat/tfm-ror52-rubygem-execjs<0:2.7.0-1.el7
0:2.7.0-1.el7
redhat/tfm-ror52-rubygem-globalid<0:0.4.1-3.el7
0:0.4.1-3.el7
redhat/tfm-ror52-rubygem-i18n<0:1.4.0-1.el7
0:1.4.0-1.el7
redhat/tfm-ror52-rubygem-loofah<0:2.2.2-2.el7
0:2.2.2-2.el7
redhat/tfm-ror52-rubygem-mail<0:2.7.0-1.el7
0:2.7.0-1.el7
redhat/tfm-ror52-rubygem-marcel<0:0.3.2-1.el7
0:0.3.2-1.el7
redhat/tfm-ror52-rubygem-mimemagic<0:0.3.2-1.el7
0:0.3.2-1.el7
redhat/tfm-ror52-rubygem-mime-types<0:3.2.2-1.el7
0:3.2.2-1.el7
redhat/tfm-ror52-rubygem-mime-types-data<0:3.2018.0812-1.el7
0:3.2018.0812-1.el7
redhat/tfm-ror52-rubygem-mustermann<0:1.0.2-1.el7
0:1.0.2-1.el7
redhat/tfm-ror52-rubygem-nio4r<0:2.3.1-1.el7
0:2.3.1-1.el7
redhat/tfm-ror52-rubygem-nokogiri<0:1.8.4-2.el7
0:1.8.4-2.el7
redhat/tfm-ror52-rubygem-rack<0:2.0.6-1.el7
0:2.0.6-1.el7
redhat/tfm-ror52-rubygem-rack-protection<0:2.0.3-1.el7
0:2.0.3-1.el7
redhat/tfm-ror52-rubygem-rack-test<0:1.1.0-1.el7
0:1.1.0-1.el7
redhat/tfm-ror52-rubygem-rails<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-rails-dom-testing<0:2.0.3-3.el7
0:2.0.3-3.el7
redhat/tfm-ror52-rubygem-rails-html-sanitizer<0:1.0.4-2.el7
0:1.0.4-2.el7
redhat/tfm-ror52-rubygem-railties<0:5.2.1-1.el7
0:5.2.1-1.el7
redhat/tfm-ror52-rubygem-sinatra<0:2.0.3-1.el7
0:2.0.3-1.el7
redhat/tfm-ror52-rubygem-sprockets<0:3.7.2-3.el7
0:3.7.2-3.el7
redhat/tfm-ror52-rubygem-sprockets-rails<0:3.2.1-1.el7
0:3.2.1-1.el7
redhat/tfm-ror52-rubygem-sqlite3<0:1.3.13-1.el7
0:1.3.13-1.el7
redhat/tfm-ror52-rubygem-thor<0:0.20.0-3.el7
0:0.20.0-3.el7
redhat/tfm-ror52-rubygem-tilt<0:2.0.8-1.el7
0:2.0.8-1.el7
redhat/tfm-ror52-rubygem-turbolinks<0:2.5.4-1.el7
0:2.5.4-1.el7
redhat/tfm-ror52-rubygem-tzinfo<0:1.2.5-1.el7
0:1.2.5-1.el7
redhat/tfm-ror52-rubygem-websocket-driver<0:0.7.0-1.el7
0:0.7.0-1.el7
redhat/tfm-ror52-rubygem-websocket-extensions<0:0.1.3-1.el7
0:0.1.3-1.el7
redhat/tfm-rubygem-activerecord-import<0:1.0.0-4.el7
0:1.0.0-4.el7
redhat/tfm-rubygem-addressable<0:2.6.0-1.el7
0:2.6.0-1.el7
redhat/tfm-rubygem-algebrick<0:0.7.3-6.el7
0:0.7.3-6.el7
redhat/tfm-rubygem-ancestry<0:3.0.0-3.el7
0:3.0.0-3.el7
redhat/tfm-rubygem-anemone<0:0.7.2-20.el7
0:0.7.2-20.el7
redhat/tfm-rubygem-angular-rails-templates<1:1.0.2-4.el7
1:1.0.2-4.el7
redhat/tfm-rubygem-apipie-bindings<0:0.2.2-2.el7
0:0.2.2-2.el7
redhat/tfm-rubygem-apipie-params<0:0.0.5-5.el7
0:0.0.5-5.el7
redhat/tfm-rubygem-apipie-rails<0:0.5.14-1.el7
0:0.5.14-1.el7
redhat/tfm-rubygem-audited<0:4.7.1-2.el7
0:4.7.1-2.el7
redhat/tfm-rubygem-clamp<0:1.1.2-5.el7
0:1.1.2-5.el7
redhat/tfm-rubygem-concurrent-ruby-edge<1:0.4.1-1.el7
1:0.4.1-1.el7
redhat/tfm-rubygem-daemons<0:1.2.3-7.el7
0:1.2.3-7.el7
redhat/tfm-rubygem-deacon<0:1.0.0-4.el7
0:1.0.0-4.el7
redhat/tfm-rubygem-declarative<0:0.0.10-1.el7
0:0.0.10-1.el7
redhat/tfm-rubygem-declarative-option<0:0.1.0-1.el7
0:0.1.0-1.el7
redhat/tfm-rubygem-deface<0:1.3.2-1.el7
0:1.3.2-1.el7
redhat/tfm-rubygem-diffy<0:3.0.1-6.el7
0:3.0.1-6.el7
redhat/tfm-rubygem-dynflow<0:1.2.3-1.el7
0:1.2.3-1.el7
redhat/tfm-rubygem-ethon<0:0.12.0-1.el7
0:0.12.0-1.el7
redhat/tfm-rubygem-excon<0:0.58.0-3.el7
0:0.58.0-3.el7
redhat/tfm-rubygem-facter<0:2.4.0-6.el7
0:2.4.0-6.el7
redhat/tfm-rubygem-faraday<0:0.15.4-1.el7
0:0.15.4-1.el7
redhat/tfm-rubygem-ffi<0:1.4.0-12.el7
0:1.4.0-12.el7
redhat/tfm-rubygem-fog-aws<0:3.5.0-1.el7
0:3.5.0-1.el7
redhat/tfm-rubygem-fog-core<0:2.1.0-1.el7
0:2.1.0-1.el7
redhat/tfm-rubygem-fog-google<0:1.8.2-1.el7
0:1.8.2-1.el7
redhat/tfm-rubygem-fog-json<0:1.2.0-1.el7
0:1.2.0-1.el7
redhat/tfm-rubygem-fog-kubevirt<0:1.3.2-1.el7
0:1.3.2-1.el7
redhat/tfm-rubygem-fog-libvirt<0:0.6.0-1.el7
0:0.6.0-1.el7
redhat/tfm-rubygem-fog-openstack<0:1.0.8-2.el7
0:1.0.8-2.el7
redhat/tfm-rubygem-fog-ovirt<0:1.1.5-1.el7
0:1.1.5-1.el7
redhat/tfm-rubygem-fog-rackspace<0:0.1.4-3.el7
0:0.1.4-3.el7
redhat/tfm-rubygem-fog-vsphere<0:3.2.1-1.el7
0:3.2.1-1.el7
redhat/tfm-rubygem-fog-xml<0:0.1.2-7.el7
0:0.1.2-7.el7
redhat/tfm-rubygem-foreman-tasks<0:0.15.11.1-1.el7
0:0.15.11.1-1.el7
redhat/tfm-rubygem-foreman-tasks-core<0:0.3.2-1.el7
0:0.3.2-1.el7
redhat/tfm-rubygem-formatador<0:0.2.1-11.el7
0:0.2.1-11.el7
redhat/tfm-rubygem-gettext<0:3.1.4-10.el7
0:3.1.4-10.el7
redhat/tfm-rubygem-git<0:1.5.0-1.el7
0:1.5.0-1.el7
redhat/tfm-rubygem-google-api-client<0:0.23.9-1.el7
0:0.23.9-1.el7
redhat/tfm-rubygem-googleauth<0:0.6.7-1.el7
0:0.6.7-1.el7
redhat/tfm-rubygem-graphql<0:1.8.14-1.el7
0:1.8.14-1.el7
redhat/tfm-rubygem-graphql-batch<0:0.3.10-1.el7
0:0.3.10-1.el7
redhat/tfm-rubygem-gssapi<0:1.2.0-6.el7
0:1.2.0-6.el7
redhat/tfm-rubygem-hashie<0:3.6.0-1.el7
0:3.6.0-1.el7
redhat/tfm-rubygem-highline<0:1.7.8-4.el7
0:1.7.8-4.el7
redhat/tfm-rubygem-http<0:3.3.0-1.el7
0:3.3.0-1.el7
redhat/tfm-rubygem-httpclient<0:2.8.3-1.el7
0:2.8.3-1.el7
redhat/tfm-rubygem-http-cookie<0:1.0.2-5.el7
0:1.0.2-5.el7
redhat/tfm-rubygem-ipaddress<0:0.8.0-11.el7
0:0.8.0-11.el7
redhat/tfm-rubygem-jgrep<0:1.3.3-12.el7
0:1.3.3-12.el7
redhat/tfm-rubygem-journald-logger<0:2.0.4-2.el7
0:2.0.4-2.el7
redhat/tfm-rubygem-journald-native<0:1.0.11-2.el7
0:1.0.11-2.el7
redhat/tfm-rubygem-jwt<0:2.1.0-2.el7
0:2.1.0-2.el7
redhat/tfm-rubygem-katello<0:3.12.0.27-1.el7
0:3.12.0.27-1.el7
redhat/tfm-rubygem-kubeclient<0:4.3.0-1.el7
0:4.3.0-1.el7
redhat/tfm-rubygem-little-plugger<0:1.1.3-24.el7
0:1.1.3-24.el7
redhat/tfm-rubygem-locale<0:2.0.9-13.el7
0:2.0.9-13.el7
redhat/tfm-rubygem-logging<0:2.2.2-5.el7
0:2.2.2-5.el7
redhat/tfm-rubygem-logging-journald<0:2.0.0-2.el7
0:2.0.0-2.el7
redhat/tfm-rubygem-memoist<0:0.16.0-1.el7
0:0.16.0-1.el7
redhat/tfm-rubygem-multipart-post<0:2.0.0-1.el7
0:2.0.0-1.el7
redhat/tfm-rubygem-net-ldap<0:0.15.0-3.el7
0:0.15.0-3.el7
redhat/tfm-rubygem-net-ping<0:2.0.1-3.el7
0:2.0.1-3.el7
redhat/tfm-rubygem-netrc<0:0.11.0-3.el7
0:0.11.0-3.el7
redhat/tfm-rubygem-net-scp<0:1.2.1-3.el7
0:1.2.1-3.el7
redhat/tfm-rubygem-net-ssh<0:4.2.0-1.el7
0:4.2.0-1.el7
redhat/tfm-rubygem-net-ssh-krb<0:0.4.0-3.el7
0:0.4.0-3.el7
redhat/tfm-rubygem-oauth<0:0.5.4-3.el7
0:0.5.4-3.el7
redhat/tfm-rubygem-optimist<0:3.0.0-1.el7
0:3.0.0-1.el7
redhat/tfm-rubygem-os<0:1.0.0-1.el7
0:1.0.0-1.el7
redhat/tfm-rubygem-ovirt-engine-sdk<0:4.2.3-3.el7
0:4.2.3-3.el7
redhat/tfm-rubygem-parse-cron<0:0.1.4-4.el7
0:0.1.4-4.el7
redhat/tfm-rubygem-passenger<0:4.0.18-10.12.el7
0:4.0.18-10.12.el7
redhat/tfm-rubygem-pg<0:0.21.0-3.el7
0:0.21.0-3.el7
redhat/tfm-rubygem-polyglot<0:0.3.5-3.el7
0:0.3.5-3.el7
redhat/tfm-rubygem-powerbar<0:2.0.1-2.el7
0:2.0.1-2.el7
redhat/tfm-rubygem-prometheus-client<0:0.7.1-3.el7
0:0.7.1-3.el7
redhat/tfm-rubygem-promise.rb<0:0.7.4-1.el7
0:0.7.4-1.el7
redhat/tfm-rubygem-quantile<0:0.2.0-3.el7
0:0.2.0-3.el7
redhat/tfm-rubygem-rabl<0:0.13.1-2.el7
0:0.13.1-2.el7
redhat/tfm-rubygem-rack-cors<0:1.0.2-1.el7
0:1.0.2-1.el7
redhat/tfm-rubygem-rack-jsonp<0:1.3.1-7.el7
0:1.3.1-7.el7
redhat/tfm-rubygem-rails-i18n<0:5.1.1-2.el7
0:5.1.1-2.el7
redhat/tfm-rubygem-rainbow<0:2.2.1-5.el7
0:2.2.1-5.el7
redhat/tfm-rubygem-rbovirt<0:0.1.7-2.el7
0:0.1.7-2.el7
redhat/tfm-rubygem-rbvmomi<0:2.2.0-1.el7
0:2.2.0-1.el7
redhat/tfm-rubygem-recursive-open-struct<0:1.1.0-1.el7
0:1.1.0-1.el7
redhat/tfm-rubygem-representable<0:3.0.4-1.el7
0:3.0.4-1.el7
redhat/tfm-rubygem-responders<0:2.4.0-2.el7
0:2.4.0-2.el7
redhat/tfm-rubygem-rest-client<0:2.0.1-4.el7
0:2.0.1-4.el7
redhat/tfm-rubygem-retriable<0:3.1.2-1.el7
0:3.1.2-1.el7
redhat/tfm-rubygem-roadie<0:3.4.0-1.el7
0:3.4.0-1.el7
redhat/tfm-rubygem-roadie-rails<0:2.0.0-1.el7
0:2.0.0-1.el7
redhat/tfm-rubygem-robotex<0:1.0.0-21.el7
0:1.0.0-21.el7
redhat/tfm-rubygem-ruby2ruby<0:2.4.0-2.el7
0:2.4.0-2.el7
redhat/tfm-rubygem-ruby-libvirt<0:0.7.0-4.el7
0:0.7.0-4.el7
redhat/tfm-rubygem-runcible<0:2.11.0-1.el7
0:2.11.0-1.el7
redhat/tfm-rubygem-safemode<0:1.3.5-2.el7
0:1.3.5-2.el7
redhat/tfm-rubygem-sequel<0:5.7.1-2.el7
0:5.7.1-2.el7
redhat/tfm-rubygem-signet<0:0.11.0-1.el7
0:0.11.0-1.el7
redhat/tfm-rubygem-sshkey<0:1.9.0-3.el7
0:1.9.0-3.el7
redhat/tfm-rubygem-statsd-instrument<0:2.1.4-2.el7
0:2.1.4-2.el7
redhat/tfm-rubygem-text<0:1.3.0-7.el7
0:1.3.0-7.el7
redhat/tfm-rubygem-typhoeus<0:1.3.1-1.el7
0:1.3.1-1.el7
redhat/tfm-rubygem-uber<0:0.1.0-1.el7
0:0.1.0-1.el7
redhat/tfm-rubygem-unf<0:0.1.3-7.el7
0:0.1.3-7.el7
redhat/tfm-rubygem-unicode<0:0.4.4.1-6.el7
0:0.4.4.1-6.el7
redhat/tfm-rubygem-webpack-rails<0:0.9.8-5.el7
0:0.9.8-5.el7
redhat/tfm-rubygem-wicked<0:1.3.3-1.el7
0:1.3.3-1.el7
redhat/tfm-rubygem-x-editable-rails<0:1.5.5-4.el7
0:1.5.5-4.el7
redhat/tfm-rubygem-zest<0:0.0.4-1.el7
0:0.0.4-1.el7
rubygems/rack>=2.0.4<2.0.6
2.0.6
redhat/rubygem-rack<2.0.6
2.0.6
Rack Project Rack=2.0.4
Rack Project Rack=2.0.5
Remediation
Event History
Nov 6, 2018
CVE Published
12:00 AM
Nov 13, 2018
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
DescriptionWeakness
Nov 15, 2018
Advisory Published
03:58 PM
Frequently Asked Questions
1
What is the severity of CVE-2018-16470?
CVE-2018-16470 has been classified as a moderate severity vulnerability due to its potential to cause denial of service (DoS) by consuming excessive CPU resources.
2
How do I fix CVE-2018-16470?
To mitigate CVE-2018-16470, upgrade Rack to version 2.0.6 or later.
3
Which versions of Rack are affected by CVE-2018-16470?
Versions of Rack prior to 2.0.6 are affected by CVE-2018-16470.
4
Is CVE-2018-16470 a remote code execution vulnerability?
No, CVE-2018-16470 is not a remote code execution vulnerability; it is specifically a denial of service vulnerability.
5
What types of applications are at risk from CVE-2018-16470?
Applications that rely on the Rack middleware framework for handling multipart requests are at risk from CVE-2018-16470.