PT-2018-3570 · Ruby+1 · Rack+1

Publicado 2018-11-06 · Atualizado 2024-06-15 · CVE-2018-16470

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.0.6

Description The issue is related to an uncontrolled resource consumption in the Rack module of the Ruby programming language interpreter. It may allow a remote attacker to cause a denial of service through specially crafted requests, potentially leading to excessive CPU resource usage.

Recommendations For versions prior to 2.0.6, update to version 2.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the multipart parser to minimize the risk of exploitation.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

BDU:2020-04925

CVE-2018-16470

GHSA-HG78-4F6X-99WQ

OPENSUSE-SU-2019:0185-1

OPENSUSE-SU-2019_0185-1

OPENSUSE-SU-2024:10589-1

RHSA-2019:3172

SUSE-SU-2019:0272-1

Produtos afetados

Rack

Suse

Referências · 39

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16470.yml · Exploit
• https://github.com/rack/rack · Nota
• https://bdu.fstec.ru/vul/2020-04925 · Nota de Segurança
• https://bugzilla.suse.com/1114831 · Nota
• https://suse.com/security/cve/CVE-2020-8166 · Nota
• https://access.redhat.com/security/cve/CVE-2018-16470 · Nota
• https://suse.com/security/cve/CVE-2018-16470 · Nota
• https://access.redhat.com/errata/RHSA-2019:3172 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-16468 · Nota
• https://bugzilla.suse.com/1102046 · Nota
• https://groups.google.com/forum/#%21msg/rubyonrails-security/U_x-YkfuVTg/xhvYAmp6AAAJ · Nota
• https://suse.com/security/cve/CVE-2020-8164 · Nota
• https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk · Nota
• https://bugzilla.suse.com/1102193 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2019:0272-1 · Aviso do Fabricante