CVE-2022-44570

CVE	CVE-2022-44570
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-02-09 20:15:00 UTC
Updated	2023-12-08 22:15:00 UTC
Description	A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Problem Types: CWE-1333

Type	Vendor	Product	Version	Update	Edition	Language
Application	Rack Project	Rack	All	All	All	All

Reference	Source	Link	Tags
Debian -- Security Information -- DSA-5530-1 ruby-rack	DEBIAN	www.debian.org
CVE-2022-44570 Rack Vulnerability in NetApp Products \| NetApp Product Security		security.netapp.com
[CVE-2022-44570] Possible Denial of Service Vulnerability in Rack's Range header parsing - Security Announcements - Ruby on Rails Discussions	MISC	discuss.rubyonrails.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

181526 Debian Security Update for ruby-rack (DLA 3298-1)
184151 Debian Security Update for ruby-rack (CVE-2022-44570)
199546 Ubuntu Security Notification for Rack Vulnerabilities (USN-5910-1)
242347 Red Hat Update for Satellite 6.14 (RHSA-2023:6818)
6000290 Debian Security Update for ruby-rack (DSA 5530-1)
691031 Free Berkeley Software Distribution (FreeBSD) Security Update for rack (95176ba5-9796-11ed-bfbf-080027f5fec9)
753622 SUSE Enterprise Linux Security Update for rubygem-rack (SUSE-SU-2023:0276-1)
961065 Rocky Linux Security Update for Satellite (RLSA-2023:6818)