SUSE-SU-2024:0765-1: Security update for rubygem-rack

Q: Which systems and architectures are covered by this update?

The update covers ruby2.5-rubygem-rack and related documentation and testsuite packages on openSUSE Leap 15.5 and SUSE Linux Enterprise High Availability Extension 15 SP2 through SP5. Listed architectures are aarch64, ppc64le, s390x, and x86_64.

Q: What types of requests can trigger the fixed denial-of-service issues?

The issues affect Rack parsing of Content-Type headers, Range request headers, and general headers. Affected applications may be exposed when they process requests containing those headers.

Q: Are the documented impacts limited to denial of service?

Yes. The update description identifies all three fixed CVEs as denial-of-service vulnerabilities and does not describe data exposure, privilege escalation, or code execution.

Published Mar 5, 2024

Updated

This update for rubygem-rack fixes the following issues: CVE-2024-25126: Fixed a denial-of-service vulnerability in Rack Content-Type parsing (bsc#1220239). CVE-2024-26141: Fixed a denial-of-service vulnerability in Range request header parsing (bsc#1220242). CVE-2024-26146: Fixed a denial-of-service vulnerability in Rack headers parsing routine (bsc#1220248).

Affected Software

12 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/ruby2.5-rubygem-rack<2.0.8-150000.3.21.2

2.0.8-150000.3.21.2

suse/ruby2.5-rubygem-rack-doc<2.0.8-150000.3.21.2

2.0.8-150000.3.21.2

suse/ruby2.5-rubygem-rack-testsuite<2.0.8-150000.3.21.2

2.0.8-150000.3.21.2

All of the following

SUSE SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64)

suse/ruby2.5-rubygem-rack<2.0.8-150000.3.21.2

2.0.8-150000.3.21.2

All of the following

SUSE SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64)

suse/ruby2.5-rubygem-rack<2.0.8-150000.3.21.2

2.0.8-150000.3.21.2

All of the following

SUSE SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64)

suse/ruby2.5-rubygem-rack<2.0.8-150000.3.21.2

2.0.8-150000.3.21.2

All of the following

SUSE SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64)

suse/ruby2.5-rubygem-rack<2.0.8-150000.3.21.2

2.0.8-150000.3.21.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/ruby2.5-rubygem-rack to a version that resolves this vulnerability.
Fixed in 2.0.8-150000.3.21.2
Upgrade
Upgrade suse/ruby2.5-rubygem-rack-doc to a version that resolves this vulnerability.
Fixed in 2.0.8-150000.3.21.2
Upgrade
Upgrade suse/ruby2.5-rubygem-rack-testsuite to a version that resolves this vulnerability.
Fixed in 2.0.8-150000.3.21.2
Upgrade
Upgrade rubygem-rack to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP2-2024-765=1
Upgrade
Upgrade rubygem-rack to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP3-2024-765=1
Upgrade
Upgrade rubygem-rack to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP4-2024-765=1
Upgrade
Upgrade rubygem-rack to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP5-2024-765=1
Upgrade
Upgrade rubygem-rack to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-765=1

Event History

Mar 5, 2024

Advisory Published

via SUSE·04:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems and architectures are covered by this update?

The update covers ruby2.5-rubygem-rack and related documentation and testsuite packages on openSUSE Leap 15.5 and SUSE Linux Enterprise High Availability Extension 15 SP2 through SP5. Listed architectures are aarch64, ppc64le, s390x, and x86_64.

What types of requests can trigger the fixed denial-of-service issues?

The issues affect Rack parsing of Content-Type headers, Range request headers, and general headers. Affected applications may be exposed when they process requests containing those headers.

Are the documented impacts limited to denial of service?

Yes. The update description identifies all three fixed CVEs as denial-of-service vulnerabilities and does not describe data exposure, privilege escalation, or code execution.

SUSE-SU-2024:0765-1: Security update for rubygem-rack

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems and architectures are covered by this update?

What types of requests can trigger the fixed denial-of-service issues?

Are the documented impacts limited to denial of service?

Company

Resources

Contact

Frequently Asked Questions

Which systems and architectures are covered by this update?

What types of requests can trigger the fixed denial-of-service issues?

Are the documented impacts limited to denial of service?