CVE-2023-27539

There is a denial of service vulnerability in the header parsing component of Rack.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• pcs: webpack: Regression of CVE-2023-28154 fixes in the AlmaLinux (CVE-2023-2319)
• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)
• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697)
• Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704)
• [WebUI] fence levels prevent loading of cluster status (BZ#2183180)

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)
• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180700)
• Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180706)

• CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
• CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
• CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
• CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
• CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

• CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
• CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
• CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
• CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
• CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1

Impact

Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.

Workarounds

Setting Regexp.timeout in Ruby 3.2 is a possible workaround.

This update to 2.2.8 fixes CVE-2023-27539 and some bugs

These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.6.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-rack-3.0.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• pcs: webpack: Regression of CVE-2023-28154 fixes in the Rocky Linux (CVE-2023-2319)

• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697)

• Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704)

• [WebUI] fence levels prevent loading of cluster status (BZ#2183180)

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180700)

• Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180706)

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)

• HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

• GitPython: Insecure non-multi options in clone and clone_from is not blocked (CVE-2023-40267)

• kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759)

• foreman: OS command injection via ct_command and fcct_command (CVE-2022-3874)

• ruby-git: code injection vulnerability (CVE-2022-46648)

• ruby-git: code injection vulnerability (CVE-2022-47318)

• Foreman: Arbitrary code execution through templates (CVE-2023-0118)

• rubygem-activerecord: SQL Injection (CVE-2023-22794)

• openssl: c_rehash script allows command injection (CVE-2022-1292)

• openssl: the c_rehash script allows command injection (CVE-2022-2068)

• Pulp:Tokens stored in plaintext (CVE-2022-3644)

• satellite: Blind SSRF via Referer header (CVE-2022-4130)

• python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server (CVE-2022-40899)

• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

• rubygem-activerecord: Denial of Service (CVE-2022-44566)

• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44570)

• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44571)

• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44572)

• Foreman: Stored cross-site scripting in host tab (CVE-2023-0119)

• puppet: Puppet Server ReDoS (CVE-2023-1894)

• rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22792)

• rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22795)

• rubygem-activesupport: Regular Expression Denial of Service (CVE-2023-22796)

• rubygem-globalid: ReDoS vulnerability (CVE-2023-22799)

• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

• sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service) (CVE-2023-30608)

• python-django: Potential bypass of validation when uploading multiple files using one form field (CVE-2023-31047)

• python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)

• python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator (CVE-2023-36053)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.

This update for rubygem-rack fixes the following issues:

• CVE-2023-27539: Fixed denial of service in header parsing (bsc#1209503).

This update for rubygem-rack fixes the following issues:

• CVE-2023-27539: Fixed denial of service in header parsing (bsc#1209503).

It was discovered that Rack incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2023-27539)

It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-27530)

It was discovered that Rack was not properly parsing data when processing multipart POST requests. If a user or automated system were tricked into sending a specially crafted multipart POST request to an application using Rack, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-30122)

It was discovered that Rack was not properly escaping untrusted data when performing logging operations, which could cause shell escaped sequences to be written to a terminal. If a user or automated system were tricked into sending a specially crafted request to an application using Rack, a remote attacker could possibly use this issue to execute arbitrary code in the machine running the application. (CVE-2022-30123)

It was discovered that Rack did not properly structure regular expressions in some of its parsing components, which could result in uncontrolled resource consumption if an application using Rack received specially crafted input. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-44570, CVE-2022-44571)

It was discovered that Rack did not properly structure regular expressions in its multipart parsing component, which could result in uncontrolled resource consumption if an application using Rack to parse multipart posts received specially crafted input. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-44572)

It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2023-27530)

It was discovered that Rack incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2023-27539)

It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126)

It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly use this issue to cause Rack to create large responses, leading to a denial of service. (CVE-2024-26141)

It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-26146)