242 lines
10 KiB
JSON
242 lines
10 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-25126",
|
||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "GitHub_M",
|
||
"dateReserved": "2024-02-05T14:14:46.381Z",
|
||
"datePublished": "2024-02-28T23:28:07.073Z",
|
||
"dateUpdated": "2025-02-13T17:40:47.635Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"title": "Rack ReDos in content type parsing (2nd degree polynomial)",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-1333",
|
||
"lang": "en",
|
||
"description": "CWE-1333: Inefficient Regular Expression Complexity",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "LOW",
|
||
"baseScore": 5.3,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "NONE",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||
"version": "3.1"
|
||
}
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"name": "https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx",
|
||
"tags": [
|
||
"x_refsource_CONFIRM"
|
||
],
|
||
"url": "https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx"
|
||
},
|
||
{
|
||
"name": "https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462"
|
||
},
|
||
{
|
||
"name": "https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49"
|
||
},
|
||
{
|
||
"name": "https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941"
|
||
},
|
||
{
|
||
"name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml"
|
||
},
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html"
|
||
},
|
||
{
|
||
"url": "https://security.netapp.com/advisory/ntap-20240510-0005/"
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "rack",
|
||
"product": "rack",
|
||
"versions": [
|
||
{
|
||
"version": ">= 3.0.0, < 3.0.9.1",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": ">= 0.4, < 2.2.8.1",
|
||
"status": "affected"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"shortName": "GitHub_M",
|
||
"dateUpdated": "2024-06-10T17:09:01.441Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1."
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "GHSA-22f2-v57c-j9cx",
|
||
"discovery": "UNKNOWN"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-01T23:36:21.617Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"name": "https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx",
|
||
"tags": [
|
||
"x_refsource_CONFIRM",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx"
|
||
},
|
||
{
|
||
"name": "https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462",
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462"
|
||
},
|
||
{
|
||
"name": "https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49",
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49"
|
||
},
|
||
{
|
||
"name": "https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941",
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941"
|
||
},
|
||
{
|
||
"name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml",
|
||
"tags": [
|
||
"x_refsource_MISC",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml"
|
||
},
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://security.netapp.com/advisory/ntap-20240510-0005/",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"affected": [
|
||
{
|
||
"vendor": "rack_project",
|
||
"product": "rack",
|
||
"cpes": [
|
||
"cpe:2.3:a:rack_project:rack:3.0.0:rc1:*:*:*:ruby:*:*"
|
||
],
|
||
"defaultStatus": "unknown",
|
||
"versions": [
|
||
{
|
||
"version": "3.0.0",
|
||
"status": "affected",
|
||
"lessThan": "3.0.9.1",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "0.4",
|
||
"status": "affected",
|
||
"lessThan": "2.2.8.1",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-08-12T17:41:06.470602Z",
|
||
"id": "CVE-2024-25126",
|
||
"options": [
|
||
{
|
||
"Exploitation": "poc"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-08-12T17:43:32.571Z"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
"dataVersion": "5.1"
|
||
} |