A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

The remote host is affected by the vulnerability described in GLSA-202310-18 (Rack: Multiple Vulnerabilities)

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5530 advisory.

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

  - A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully     crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time,     possibly resulting in a denial of service attack vector. Any applications that deal with Range requests     (such as streaming applications, or applications that serve files) may be impacted. (CVE-2022-44570)

  - There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in     2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-     Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial     ofservice attack vector. This header is used typically used in multipartparsing. Any applications that     parse multipart posts using Rack (virtuallyall Rails applications) are impacted. (CVE-2022-44571)

  - A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2,     2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary     parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack     vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are     impacted. (CVE-2022-44572)

  - A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart     MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart     parsing to take longer than expected. (CVE-2023-27530)

  - The Ruby on Rails advisory describes this vulnerability as follows: (CVE-2023-27539)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5253-1 advisory.

  - There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This     vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions     by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database     that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the     amount of time it takes to look up a session, an attacker may be able to find a valid session id and     hijack the session. The session id itself may be generated randomly, but the way the session is indexed by     the backing store does not use a secure comparison. (CVE-2019-16782)

  - A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3,     rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
    (CVE-2020-8184)

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1486 advisory.

  - puma-5.6.4: http request smuggling vulnerabilities (CVE-2022-24790)

  - rubygem-rack: crafted multipart POST request may cause a DoS (CVE-2022-30122)

  - rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - rubygem-tzinfo: arbitrary code execution (CVE-2022-31163)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5896-1 advisory.

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1895 advisory.

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:7343-1 advisory.

  - rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7343 advisory.

  - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true,     {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable
    __proto__ property, it could extend the native Object.prototype. (CVE-2019-11358)

  - rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7343 advisory.

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3095 advisory.

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2192-1 advisory.

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184012	GLSA-202310-18 : Rack: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
183679	Debian DSA-5530-1 : ruby-rack - security update	Nessus	Debian Local Security Checks	critical
183143	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Rack vulnerabilities (USN-5253-1)	Nessus	Ubuntu Local Security Checks	critical
173453	RHEL 7 : Red Hat Gluster Storage web-admin-build (RHSA-2023:1486)	Nessus	Red Hat Local Security Checks	critical
171938	Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : Rack vulnerabilities (USN-5896-1)	Nessus	Ubuntu Local Security Checks	critical
168451	Amazon Linux 2 : pcs (ALAS-2022-1895)	Nessus	Amazon Linux Local Security Checks	critical
167259	Scientific Linux Security Update : pcs on SL7.x x86_64 (2022:7343)	Nessus	Scientific Linux Local Security Checks	critical
166935	Oracle Linux 7 : pcs (ELSA-2022-7343)	Nessus	Oracle Linux Local Security Checks	critical
166903	RHEL 7 : pcs (RHSA-2022:7343)	Nessus	Red Hat Local Security Checks	critical
164675	Debian DLA-3095-1 : ruby-rack - LTS security update	Nessus	Debian Local Security Checks	critical
162555	SUSE SLES15 Security Update : rubygem-rack (SUSE-SU-2022:2192-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2022-30123

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical