PT-2023-2035 · Rack+9 · Rack+9
Das7Pad
·
Published
2023-03-08
·
Updated
2026-03-13
·
CVE-2023-27530
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Rack versions prior to 3.0.4.2
Rack versions prior to 2.2.6.3
Rack versions prior to 2.1.4.3
Rack versions prior to 2.0.9.3
Description
A DoS issue exists in the Multipart MIME parsing code, allowing an attacker to craft requests that can be abused to cause multipart parsing to take longer than expected. This could lead to an exploitation that allows a remote attacker to cause a denial of service. The Multipart MIME parsing code limits the number of file parts but does not limit the total number of parts that can be uploaded, which can be exploited by carefully crafted requests.
Recommendations
For versions prior to 3.0.4.2, update to version 3.0.4.2 or later.
For versions prior to 2.2.6.3, update to version 2.2.6.3 or later.
For versions prior to 2.1.4.3, update to version 2.1.4.3 or later.
For versions prior to 2.0.9.3, update to version 2.0.9.3 or later.
As a temporary workaround, consider configuring a proxy to limit the POST body size to mitigate this issue.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Rack
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu