First published: Fri Feb 23 2024(Updated: )
### Summary ```ruby module Rack class MediaType SPLIT_PATTERN = %r{\s*[;,]\s*} ``` The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split. ### PoC A simple HTTP request with lots of blank characters in the content-type header: ```ruby request["Content-Type"] = (" " * 50_000) + "a," ``` ### Impact It's a very easy to craft ReDoS. Like all ReDoS the impact is debatable.
Credit: security-advisories@github.com security-advisories@github.com
Affected Software | Affected Version | How to fix |
---|---|---|
rubygems/rack | >=0.4<2.2.8.1 | 2.2.8.1 |
rubygems/rack | >=3.0.0<3.0.9.1 | 3.0.9.1 |
redhat/rubygem-rack | <3.0.9.1 | 3.0.9.1 |
redhat/rubygem-rack | <2.2.8.1 | 2.2.8.1 |
debian/ruby-rack | 2.1.4-3+deb11u2 2.2.6.4-1+deb12u1 2.2.7-1.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.