CVE-2022-44571: High severity Rack Project Rack Ruby vulnerability
Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Other sources
There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-44571.
What is the severity of CVE-2022-44571?
The severity of CVE-2022-44571 is high with a severity value of 7.5.
Which versions of Rack are affected by CVE-2022-44571?
Versions >= 2.0.0 of Rack are affected by CVE-2022-44571.
How do I fix CVE-2022-44571?
To fix CVE-2022-44571, update Rack to versions 2.0.9.2, 2.1.4.2, 2.2.6.1, or 3.0.0.1.
Where can I find more information about CVE-2022-44571?
You can find more information about CVE-2022-44571 at the following references: [Link 1](https://discuss.rubyonrails.org/t/cve-2022-44571-possible-denial-of-service-vulnerability-in-rack-content-disposition-parsing/82126), [Link 2](https://www.debian.org/security/2023/dsa-5530), [Link 3](https://github.com/rack/rack/commit/4e33ad10bf5f16d25c156f905bcc548e7f787bc3).