REDHAT-BUG-2440737: High severity Rack Rack::Directory vulnerability
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory’s path check used a string prefix match on the expanded path. A request like /../rootexample/ can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rack::Directoryto a version that resolves this vulnerability.Fixed in 2.2.22 - Upgrade
Upgrade
Rack::Directoryto a version that resolves this vulnerability.Fixed in 3.1.20 - Upgrade
Upgrade
Rack::Directoryto a version that resolves this vulnerability.Fixed in 3.2.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2440737?
The severity of REDHAT-BUG-2440737 is high, rated at 7.
How do I fix REDHAT-BUG-2440737?
To fix REDHAT-BUG-2440737, upgrade Rack to versions 2.2.22, 3.1.20, or 3.2.5 or later.
What is the risk associated with REDHAT-BUG-2440737?
The risk associated with REDHAT-BUG-2440737 is rated at 33.
What does REDHAT-BUG-2440737 affect?
REDHAT-BUG-2440737 affects the Rack web server interface, specifically the Rack::Directory component.
What type of vulnerability is REDHAT-BUG-2440737?
REDHAT-BUG-2440737 is a path traversal vulnerability that allows directory escaping.