USN-6837-1: Rack vulnerabilities
It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-27530) It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126) It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly use this issue to cause Rack to create large responses, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26141) It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26146)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6837-1?
The severity of USN-6837-1 is classified as a denial of service vulnerability.
How do I fix USN-6837-1?
To fix USN-6837-1, update the ruby-rack package to version 2.2.7-1ubuntu0.1 or 2.2.4-3ubuntu0.2 depending on your Ubuntu version.
Which versions of Ubuntu are affected by USN-6837-1?
USN-6837-1 affects Ubuntu 23.10 and Ubuntu 24.04 if running vulnerable versions of ruby-rack.
What kind of attack can USN-6837-1 expose my system to?
USN-6837-1 can expose your system to resource exhaustion attacks leading to a denial of service.
Is USN-6837-1 related to any specific software?
Yes, USN-6837-1 specifically relates to the ruby-rack package.