GitHub Advisoryadvisory · RubyGems

GHSA-3pxh-h8hw-mj8w Rack rubygems receiving excessively long lines triggers out-of-memory error

MEDIUM Published 2017-10-24 Modified 2023-08-28 Official page ↗
Aliases
CVE-2013-0183
Ecosystem
RubyGems
Packages
rack
Severity
Moderate
Weaknesses
CWE-119, CWE-400
Reviewed
2020-06-16

Affected packages

• RubyGems rack: >= 1.3.0, < 1.3.8 → fixed in 1.3.8 • RubyGems rack: >= 1.4.0, < 1.4.3 → fixed in 1.4.3

Description

multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.

Related

Alias · CVE (1)

  • CVE-2013-0183 multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory… vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References