CVE-2024-25126
Rack ReDos in content type parsing (2nd degree polynomial)
Résumé
Rack ReDos in content type parsing (2nd degree polynomial)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-25126 ruby-rack Corrigé dans: 2.1.4-3+deb11u2
Références
- advisory github.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com
- patch github.com
- web discuss.rubyonrails.org
- web lists.debian.org