PT-2022-16287 · Sidekiq+4 · Sidekiq+4

Sqbell · Published 2022-01-21 · Updated 2025-12-15 · CVE-2022-23837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Sidekiq versions prior to 5.2.10 Sidekiq versions prior to 6.4.0

Description The issue arises from the lack of a limit on the number of days when requesting stats for the graph in api.rb in Sidekiq. This leads to an overload of the system, affecting the Web UI and making it unavailable to users.

Recommendations For versions prior to 5.2.10, update to version 5.2.10 or later to resolve the issue. For versions prior to 6.4.0, update to version 6.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the api.rb file or limiting the number of days when requesting stats for the graph to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2022-23837

DLA-2943-1

DLA-3360-1

DLA-4407-1

GHSA-JRFJ-98QG-QJGV

RHSA-2022:5498

RLSA-2022:5498

USN-7695-1

Affected Products

Debian

Linuxmint

Rocky Linux

Sidekiq

Ubuntu

References · 500

• 🔥 https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md · Exploit
• https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956 · Patch
• https://github.com/rubysec/ruby-advisory-db/pull/495 · Patch
• https://osv.dev/vulnerability/RLSA-2022:5498 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23837 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23837 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2943-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23837 · Security Note
• https://osv.dev/vulnerability/USN-7695-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30151 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23837 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23837 · Security Note
• https://errata.rockylinux.org/RLSA-2022:5498 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jrfj-98qg-qjgv · Vendor Advisory