Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2113 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2581 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2584 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2113 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3800 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2007 advisory.

  - rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

  - rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

  - rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1841 advisory.

  - rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

  - rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

  - rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1846 advisory.

  - rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

  - rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

  - rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0946-1 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2492 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0765-1 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195679	RHEL 7 : rubygem-rack (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195026	Oracle Linux 9 : pcs (ELSA-2024-2113)	Nessus	Oracle Linux Local Security Checks	medium
194845	RHEL 8 : pcs (RHSA-2024:2581)	Nessus	Red Hat Local Security Checks	medium
194825	RHEL 8 : pcs (RHSA-2024:2584)	Nessus	Red Hat Local Security Checks	medium
194801	RHEL 9 : pcs (RHSA-2024:2113)	Nessus	Red Hat Local Security Checks	medium
194449	Debian dla-3800 : ruby-rack - security update	Nessus	Debian Local Security Checks	medium
193775	RHEL 8 : pcs (RHSA-2024:2007)	Nessus	Red Hat Local Security Checks	medium
193416	RHEL 9 : pcs (RHSA-2024:1841)	Nessus	Red Hat Local Security Checks	medium
193374	RHEL 9 : pcs (RHSA-2024:1846)	Nessus	Red Hat Local Security Checks	medium
192492	SUSE SLES12 Security Update : rubygem-rack-1_4 (SUSE-SU-2024:0946-1)	Nessus	SuSE Local Security Checks	medium
192209	Amazon Linux 2 : pcs (ALAS-2024-2492)	Nessus	Amazon Linux Local Security Checks	medium
191622	SUSE SLES15 / openSUSE 15 Security Update : rubygem-rack (SUSE-SU-2024:0765-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-25126

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium