REDHAT-BUG-2398167: Medium severity Rack Rack vulnerability
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rack::QueryParserto a version that resolves this vulnerability.Fixed in 2.2.18
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2398167?
The severity of REDHAT-BUG-2398167 is considered critical due to the potential for parameter count bypass by attackers.
How do I fix REDHAT-BUG-2398167?
To fix REDHAT-BUG-2398167, upgrade Rack to version 2.2.18 or later where the issue has been addressed.
What is the nature of the vulnerability in REDHAT-BUG-2398167?
The vulnerability in REDHAT-BUG-2398167 involves improper enforcement of parameter limits in Rack::QueryParser, allowing attackers to bypass limits by using semicolons.
What versions of Rack are affected by REDHAT-BUG-2398167?
Rack versions prior to 2.2.18 are affected by REDHAT-BUG-2398167.
Can REDHAT-BUG-2398167 lead to other attacks besides parameter count bypass?
Yes, REDHAT-BUG-2398167 can potentially lead to denial of service or other injection attacks due to excessive parameters being processed.