Bugzilla – Bug 934797
VUL-0: CVE-2015-3225: rubygem-rack: Potential Denial of Service Vulnerability in Rack
Last modified: 2017-06-12 14:43:06 UTC
EMBARGOED CRD: 2015-06-16 Potential Denial of Service Vulnerability in Rack There is a potential denial of service vulnerability in Rack. This vulnerability has been assigned the CVE identifier CVE-2015-3225. Versions Affected: All. Not affected: None. Fixed Versions: 1.6.2, 1.5.4 Impact ------ Carefully crafted requests can cause a `SystemStackError` and potentially cause a denial of service attack. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The FIXED releases are available at the normal locations. Workarounds ----------- There are no feasible workarounds for this issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 1-6-deep_params.patch - Patch for 1.6 series * 1-5-deep_params.patch - Patch for 1.5 series Please note that only the 1.6.x and 1.5.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. Credits ------- Special thanks to Tomek Rabczak from the NCC Group for reporting this!
bugbot adjusting priority
public
rubygem-rack, rubygem-rack-1_3, rubygem-rack-1_4 are maintained. rubygem-rack-1_5 is also in some devel projects.
rubygem-rack, rubygem-rack-1_3, rubygem-rack-1_4 are maintained in openSUSE 13.2 and 13.1 rubygem-rack-1_5 is in devel:languages:ruby:extensions
Created attachment 640307 [details] test code run "ruby test-cve-2015-3225.rb" If the patch has been applied, you should get a RangeError. Otherwise it means there is no limit and so it is vulnerable.
Created attachment 640357 [details] patch for 1.1.x version
Created attachment 640384 [details] patch for 1.4.*
Created attachment 640399 [details] patch for 1.3
Created attachment 640401 [details] patch for 1.3 the previous patch was wrong ...
This is an autogenerated message for OBS integration: This bug (934797) was mentioned in https://build.opensuse.org/request/show/315622 13.2+13.1 / rubygem-rack
This is an autogenerated message for OBS integration: This bug (934797) was mentioned in https://build.opensuse.org/request/show/315643 13.2+13.1 / rubygem-rack-1_3
This is an autogenerated message for OBS integration: This bug (934797) was mentioned in https://build.opensuse.org/request/show/315657 13.2+13.1 / rubygem-rack-1_4
openSUSE-SU-2015:1259-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934797 CVE References: CVE-2015-3225 Sources used: openSUSE 13.2 (src): rubygem-rack-1.5.2-4.3.1 openSUSE 13.1 (src): rubygem-rack-1.5.2-2.3.1
openSUSE-SU-2015:1262-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934797 CVE References: CVE-2015-3225 Sources used: openSUSE 13.2 (src): rubygem-rack-1_4-1.4.5-5.3.1 openSUSE 13.1 (src): rubygem-rack-1_4-1.4.5-3.3.1
openSUSE-SU-2015:1263-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934797 CVE References: CVE-2015-3225 Sources used: openSUSE 13.2 (src): rubygem-rack-1_3-1.3.10-5.3.1 openSUSE 13.1 (src): rubygem-rack-1_3-1.3.10-3.3.1
SUSE-SU-2015:1522-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934797 CVE References: CVE-2015-3225 Sources used: SUSE Webyast 1.3 (src): rubygem-rack-1_4-1.4.5-0.7.3 SUSE Studio Onsite 1.3 (src): rubygem-rack-1_4-1.4.5-0.7.3 SUSE Linux Enterprise Software Development Kit 11-SP4 (src): rubygem-rack-1_4-1.4.5-0.7.3 SUSE Linux Enterprise Software Development Kit 11-SP3 (src): rubygem-rack-1_4-1.4.5-0.7.3 SUSE Lifecycle Management Server 1.3 (src): rubygem-rack-1_4-1.4.5-0.7.3
SUSE-SU-2015:1888-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934797 CVE References: CVE-2015-3225 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP3 (src): rubygem-rack-1.1.6-0.11.2 SUSE Lifecycle Management Server 1.3 (src): rubygem-rack-1.1.6-0.11.2
SUSE-SU-2015:2190-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934797 CVE References: CVE-2015-3225 Sources used: SUSE Linux Enterprise Module for Containers 12 (src): rubygem-rack-1_4-1.4.5-8.10 SUSE Enterprise Storage 2 (src): rubygem-rack-1_4-1.4.5-8.10 SUSE Enterprise Storage 1.0 (src): rubygem-rack-1_4-1.4.5-8.10
likelya all released now.
SUSE-SU-2015:2274-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 934797 CVE References: CVE-2015-3225 Sources used: SUSE OpenStack Cloud 5 (src): rubygem-rack-1.5.2-9.6