CVE-2013-0183 Rack rubygems receiving excessively long lines triggers out-of-memory error
MediumCVSS 5.0
EPSS 3.8%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rack(RubyGems) | >= 1.3.0, < 1.3.8 | 1.3.8 |
| rubygems rack(RubyGems) | >= 1.4.0, < 1.4.3 | 1.4.3 |
| rubygems rack(RubyGems) | = 1.3.0 | No fix listed |
| rubygems rack(RubyGems) | = 1.3.1 | No fix listed |
| rubygems rack(RubyGems) | = 1.3.2 | No fix listed |
| rubygems rack(RubyGems) | = 1.3.3 | No fix listed |
| rubygems rack(RubyGems) | = 1.3.4 | No fix listed |
| rubygems rack(RubyGems) | = 1.3.5 | No fix listed |
| rubygems rack(RubyGems) | = 1.3.6 | No fix listed |
| rubygems rack(RubyGems) | = 1.3.7 | No fix listed |
| rubygems rack(RubyGems) | = 1.4.0 | No fix listed |
| rubygems rack(RubyGems) | = 1.4.1 | No fix listed |
| rubygems rack(RubyGems) | = 1.4.2 | No fix listed |
| debian/ruby-rack(Debian:12) | < 1.4.1-2.1 | 1.4.1-2.1 |
| debian/ruby-rack(Debian:13) | < 1.4.1-2.1 | 1.4.1-2.1 |
| debian/ruby-rack(Debian:14) | < 1.4.1-2.1 | 1.4.1-2.1 |
| rack project rack | = 1.3.0 | No fix listed |
| rack project rack | = 1.3.1 | No fix listed |
| rack project rack | = 1.3.2 | No fix listed |
| rack project rack | = 1.3.3 | No fix listed |
| rack project rack | = 1.3.4 | No fix listed |
| rack project rack | = 1.3.5 | No fix listed |
| rack project rack | = 1.3.6 | No fix listed |
| rack project rack | = 1.3.7 | No fix listed |
| rack project rack | = 1.4.0 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rack project rack | = 1.4.1 | No fix listed |
| rack project rack | = 1.4.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugzilla.redhat.com
- groups.google.com
- openSUSE-SU-2013:0462 vendor-advisory
- rack.github.com
- DSA-2783 vendor-advisory
- access.redhat.com
- access.redhat.com
- github.com exploit
- RHSA-2013:0544 vendor-advisory
- RHSA-2013:0548 vendor-advisory
- github.com
- github.com product
- Debian Security Tracker CVE-2013-0183 vendor-advisory
- bugs.debian.org issue-tracking