{ "schema_version": "1.7.0", "id": "MGASA-2023-0106", "published": "2023-03-24T05:55:49Z", "modified": "2023-03-24T04:41:51Z", "summary": "Updated ruby-rack packages fix security vulnerability", "details": "A denial of service vulnerability in the Range header parsing component of\nRack >= 1.5.0. A Carefully crafted input can cause the Range header parsing\ncomponent in Rack to take an unexpected amount of time, possibly resulting\nin a denial of service attack vector. Any applications that deal with Range\nrequests (such as streaming applications, or applications that serve files)\nmay be impacted. (CVE-2022-44570)\n\nThere is a denial of service vulnerability in the Content-Disposition\nparsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This\ncould allow an attacker to craft an input that can cause Content-Disposition\nheader parsing in Rackto take an unexpected amount of time, possibly\nresulting in a denial ofservice attack vector. This header is used typically\nused in multipartparsing. Any applications that parse multipart posts using\nRack (virtuallyall Rails applications) are impacted. (CVE-2022-44571)\n\nA denial of service vulnerability in the multipart parsing component of Rack\nfixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker to\ncraft input that can cause RFC2183 multipart boundary parsing in Rack to\ntake an unexpected amount of time, possibly resulting in a denial of service\nattack vector. Any applications that parse multipart posts using Rack\n(virtually all Rails applications) are impacted. (CVE-2022-44572)\n\nA DoS vulnerability exists in Rack