PT-2018-3570 · Ruby+1 · Rack+1

Published 2018-11-06 · Updated 2024-06-15 · CVE-2018-16470

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.0.6

Description The issue is related to an uncontrolled resource consumption in the Rack module of the Ruby programming language interpreter. It may allow a remote attacker to cause a denial of service through specially crafted requests, potentially leading to excessive CPU resource usage.

Recommendations For versions prior to 2.0.6, update to version 2.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the multipart parser to minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2020-04925

CVE-2018-16470

GHSA-HG78-4F6X-99WQ

OPENSUSE-SU-2019:0185-1

OPENSUSE-SU-2019_0185-1

OPENSUSE-SU-2024:10589-1

RHSA-2019:3172

SUSE-SU-2019:0272-1

Affected Products

Rack

Suse

References · 39

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16470.yml · Exploit
• https://bdu.fstec.ru/vul/2020-04925 · Security Note
• https://access.redhat.com/errata/RHSA-2019:3172 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0272-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16470 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10589-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hg78-4f6x-99wq · Vendor Advisory
• https://github.com/rack/rack · Note
• https://bugzilla.suse.com/1114831 · Note
• https://suse.com/security/cve/CVE-2020-8166 · Note
• https://access.redhat.com/security/cve/CVE-2018-16470 · Note
• https://suse.com/security/cve/CVE-2018-16470 · Note
• https://suse.com/security/cve/CVE-2018-16468 · Note
• https://bugzilla.suse.com/1102046 · Note