PT-2023-8901 · Rack+6 · Rack+6
Ooooooo_Q
·
Published
2023-01-18
·
Updated
2026-03-13
·
CVE-2022-44570
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Rack versions 1.5.0 through 2.0.9.1
Rack versions 2.1.0 through 2.1.4.1
Rack versions 2.2.0 through 2.2.6.1
Rack versions 3.0.0 through 3.0.0.0
Description
A denial of service vulnerability in the Range header parsing component of Rack can cause the component to take an unexpected amount of time when processing carefully crafted input, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests, such as streaming applications or applications that serve files, may be impacted.
Recommendations
For Rack versions 1.5.0 through 2.0.9.1, update to version 2.0.9.2.
For Rack versions 2.1.0 through 2.1.4.1, update to version 2.1.4.2.
For Rack versions 2.2.0 through 2.2.6.1, update to version 2.2.6.2.
For Rack versions 3.0.0 through 3.0.0.0, update to version 3.0.0.1.
As a temporary workaround, consider restricting access to the Range header parsing component until a patch is available.
Apply the provided patches for the respective release series if an immediate upgrade is not possible.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Rack
Red Os
Rocky Linux
Suse
Ubuntu