Bug 934797 (CVE-2015-3225) - VUL-0: CVE-2015-3225: rubygem-rack: Potential Denial of Service Vulnerability in Rack
Summary: VUL-0: CVE-2015-3225: rubygem-rack: Potential Denial of Service Vulnerability...
Status: RESOLVED FIXED
Alias: CVE-2015-3225
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:RedHat:CVE-2015-3225:4.3:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-15 19:55 UTC by Andreas Stieger
Modified: 2017-06-12 14:43 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
test code (72 bytes, application/x-ruby)
2015-07-07 18:09 UTC, Jordi Massaguer
Details
patch for 1.1.x version (1.94 KB, patch)
2015-07-08 10:42 UTC, Jordi Massaguer
Details | Diff
patch for 1.4.* (2.71 KB, patch)
2015-07-08 14:14 UTC, Jordi Massaguer
Details | Diff
patch for 1.3 (1.85 KB, patch)
2015-07-08 17:24 UTC, Jordi Massaguer
Details | Diff
patch for 1.3 (1.88 KB, patch)
2015-07-08 17:33 UTC, Jordi Massaguer
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-06-15 19:55:27 UTC
EMBARGOED
CRD: 2015-06-16

Potential Denial of Service Vulnerability in Rack

There is a potential denial of service vulnerability in Rack. This
vulnerability has been assigned the CVE identifier CVE-2015-3225.

Versions Affected:  All.
Not affected:       None.
Fixed Versions:     1.6.2, 1.5.4

Impact 
------ 
Carefully crafted requests can cause a `SystemStackError` and potentially
cause a denial of service attack.

All users running an affected release should either upgrade or use one of the workarounds immediately. 

Releases 
-------- 
The FIXED releases are available at the normal locations. 

Workarounds 
----------- 
There are no feasible workarounds for this issue. 


Patches 
------- 
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series.  They are in git-am format and consist of a single changeset. 

* 1-6-deep_params.patch - Patch for 1.6 series 
* 1-5-deep_params.patch - Patch for 1.5 series 

Please note that only the 1.6.x and 1.5.x series are supported at present.  Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits 
------- 

Special thanks to Tomek Rabczak from the NCC Group for reporting this!
Comment 3 Swamp Workflow Management 2015-06-15 22:01:13 UTC
bugbot adjusting priority
Comment 4 Andreas Stieger 2015-06-16 18:35:38 UTC
public
Comment 5 Marcus Meissner 2015-06-17 12:29:08 UTC
rubygem-rack, rubygem-rack-1_3, rubygem-rack-1_4 are maintained.

rubygem-rack-1_5 is also in some devel projects.
Comment 7 Jordi Massaguer 2015-07-01 12:04:42 UTC
rubygem-rack, rubygem-rack-1_3, rubygem-rack-1_4 are maintained in openSUSE 13.2 and 13.1

rubygem-rack-1_5 is in devel:languages:ruby:extensions
Comment 11 Jordi Massaguer 2015-07-07 18:09:58 UTC
Created attachment 640307 [details]
test code

run "ruby test-cve-2015-3225.rb"

If the patch has been applied, you should get a RangeError.

Otherwise it means there is no limit and so it is vulnerable.
Comment 13 Jordi Massaguer 2015-07-08 10:42:53 UTC
Created attachment 640357 [details]
patch for 1.1.x version
Comment 17 Jordi Massaguer 2015-07-08 14:14:13 UTC
Created attachment 640384 [details]
patch for 1.4.*
Comment 19 Jordi Massaguer 2015-07-08 17:24:05 UTC
Created attachment 640399 [details]
patch for 1.3
Comment 20 Jordi Massaguer 2015-07-08 17:33:11 UTC
Created attachment 640401 [details]
patch for 1.3

the previous patch was wrong ...
Comment 21 Bernhard Wiedemann 2015-07-08 18:00:09 UTC
This is an autogenerated message for OBS integration:
This bug (934797) was mentioned in
https://build.opensuse.org/request/show/315622 13.2+13.1 / rubygem-rack
Comment 22 Bernhard Wiedemann 2015-07-09 08:00:14 UTC
This is an autogenerated message for OBS integration:
This bug (934797) was mentioned in
https://build.opensuse.org/request/show/315643 13.2+13.1 / rubygem-rack-1_3
Comment 23 Bernhard Wiedemann 2015-07-09 09:00:17 UTC
This is an autogenerated message for OBS integration:
This bug (934797) was mentioned in
https://build.opensuse.org/request/show/315657 13.2+13.1 / rubygem-rack-1_4
Comment 24 Swamp Workflow Management 2015-07-17 15:07:52 UTC
openSUSE-SU-2015:1259-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 934797
CVE References: CVE-2015-3225
Sources used:
openSUSE 13.2 (src):    rubygem-rack-1.5.2-4.3.1
openSUSE 13.1 (src):    rubygem-rack-1.5.2-2.3.1
Comment 25 Swamp Workflow Management 2015-07-17 15:08:42 UTC
openSUSE-SU-2015:1262-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 934797
CVE References: CVE-2015-3225
Sources used:
openSUSE 13.2 (src):    rubygem-rack-1_4-1.4.5-5.3.1
openSUSE 13.1 (src):    rubygem-rack-1_4-1.4.5-3.3.1
Comment 26 Swamp Workflow Management 2015-07-17 15:08:58 UTC
openSUSE-SU-2015:1263-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 934797
CVE References: CVE-2015-3225
Sources used:
openSUSE 13.2 (src):    rubygem-rack-1_3-1.3.10-5.3.1
openSUSE 13.1 (src):    rubygem-rack-1_3-1.3.10-3.3.1
Comment 27 Swamp Workflow Management 2015-09-09 16:16:02 UTC
SUSE-SU-2015:1522-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 934797
CVE References: CVE-2015-3225
Sources used:
SUSE Webyast 1.3 (src):    rubygem-rack-1_4-1.4.5-0.7.3
SUSE Studio Onsite 1.3 (src):    rubygem-rack-1_4-1.4.5-0.7.3
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    rubygem-rack-1_4-1.4.5-0.7.3
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    rubygem-rack-1_4-1.4.5-0.7.3
SUSE Lifecycle Management Server 1.3 (src):    rubygem-rack-1_4-1.4.5-0.7.3
Comment 28 Swamp Workflow Management 2015-11-02 16:32:01 UTC
SUSE-SU-2015:1888-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 934797
CVE References: CVE-2015-3225
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    rubygem-rack-1.1.6-0.11.2
SUSE Lifecycle Management Server 1.3 (src):    rubygem-rack-1.1.6-0.11.2
Comment 29 Swamp Workflow Management 2015-12-03 18:12:18 UTC
SUSE-SU-2015:2190-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 934797
CVE References: CVE-2015-3225
Sources used:
SUSE Linux Enterprise Module for Containers 12 (src):    rubygem-rack-1_4-1.4.5-8.10
SUSE Enterprise Storage 2 (src):    rubygem-rack-1_4-1.4.5-8.10
SUSE Enterprise Storage 1.0 (src):    rubygem-rack-1_4-1.4.5-8.10
Comment 30 Marcus Meissner 2015-12-08 13:35:40 UTC
likelya all released now.
Comment 31 Swamp Workflow Management 2015-12-16 00:10:51 UTC
SUSE-SU-2015:2274-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 934797
CVE References: CVE-2015-3225
Sources used:
SUSE OpenStack Cloud 5 (src):    rubygem-rack-1.5.2-9.6