VDB
CVE-2022-44572
CVE-2022-44572
PUBLISHED
CVSS 7.5 HIGH
Reported by hackerone · Published February 9, 2023
A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/rack/rack | 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1 |
| n/a | https://github.com/rack/rack | 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1, *, 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1 |
| RubyGems | rack | 0, 2.1.0, 2.2.0 |
Timeline
- CVE Published
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 22, 2023 EPSS Score
- May 1, 2023 EPSS Score
- Jun 9, 2023 EPSS Score
- Jul 27, 2023 PoC Published
- Aug 28, 2023 EPSS Score
- Oct 7, 2023 EPSS Score
- Nov 16, 2023 EPSS Score
- Dec 26, 2023 EPSS Score
- Feb 3, 2024 EPSS Score
References
- DSA-5530 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-44572 advisory
- https://github.com/rack/rack/releases/tag/v3.0.4.1 url
- https://github.com/advisories/GHSA-rqv2-275x-2jq5 advisory