CVE-2023-27530

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

Impact

The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

A proxy can be configured to limit the POST body size which will mitigate this issue.

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• pcs: webpack: Regression of CVE-2023-28154 fixes in the AlmaLinux (CVE-2023-2319)
• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)
• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697)
• Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704)
• [WebUI] fence levels prevent loading of cluster status (BZ#2183180)

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)
• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180700)
• Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180706)

• CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
• CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
• CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
• CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
• CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

• CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
• CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
• CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
• CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
• CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted. (CVE-2022-44570)

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted. (CVE-2022-44571)

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker to craft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. (CVE-2022-44572)

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected. (CVE-2023-27530)

These are all security issues fixed in the ruby3.1-rubygem-rack-3.0.4.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.6.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rmt-server-2.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• pcs: webpack: Regression of CVE-2023-28154 fixes in the Rocky Linux (CVE-2023-2319)

• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697)

• Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704)

• [WebUI] fence levels prevent loading of cluster status (BZ#2183180)

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180700)

• Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180706)

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)

• HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

• GitPython: Insecure non-multi options in clone and clone_from is not blocked (CVE-2023-40267)

• kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759)

• foreman: OS command injection via ct_command and fcct_command (CVE-2022-3874)

• ruby-git: code injection vulnerability (CVE-2022-46648)

• ruby-git: code injection vulnerability (CVE-2022-47318)

• Foreman: Arbitrary code execution through templates (CVE-2023-0118)

• rubygem-activerecord: SQL Injection (CVE-2023-22794)

• openssl: c_rehash script allows command injection (CVE-2022-1292)

• openssl: the c_rehash script allows command injection (CVE-2022-2068)

• Pulp:Tokens stored in plaintext (CVE-2022-3644)

• satellite: Blind SSRF via Referer header (CVE-2022-4130)

• python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server (CVE-2022-40899)

• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

• rubygem-activerecord: Denial of Service (CVE-2022-44566)

• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44570)

• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44571)

• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44572)

• Foreman: Stored cross-site scripting in host tab (CVE-2023-0119)

• puppet: Puppet Server ReDoS (CVE-2023-1894)

• rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22792)

• rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22795)

• rubygem-activesupport: Regular Expression Denial of Service (CVE-2023-22796)

• rubygem-globalid: ReDoS vulnerability (CVE-2023-22799)

• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

• rubygem-rack: denial of service in header parsing (CVE-2023-27539)

• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

• sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service) (CVE-2023-30608)

• python-django: Potential bypass of validation when uploading multiple files using one form field (CVE-2023-31047)

• python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)

• python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator (CVE-2023-36053)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.

This update for rubygem-rack fixes the following issues:

• CVE-2023-27530: Fixed denial of service in Multipart MIME parsing (bsc#1209095).

This update for rmt-server fixes the following issues:

Updated to version 2.13:

• CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency (bsc#1209507).
• CVE-2023-27530: Fixed a denial of service issue in multipart request parsing (bsc#1209096).

Non-security fixes:

• Fixed transactional update on GCE (bsc#1211398).
• Use HTTPS in rmt-client-setup-res (bsc#1209825).
• Various build fixes (bsc#1207670, bsc#1203171, bsc#1206593, bsc#1202053).

This update for rmt-server fixes the following issues:

Updated to version 2.13:

• CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency (bsc#1209507).
• CVE-2023-27530: Fixed a denial of service issue in multipart request parsing (bsc#1209096).

Non-security fixes:

• Fixed transactional update on GCE (bsc#1211398).
• Use HTTPS in rmt-client-setup-res (bsc#1209825).
• Various build fixes (bsc#1207670, bsc#1203171, bsc#1206593, bsc#1202053).

This update for rmt-server fixes the following issues:

Updated to version 2.13:

• CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency (bsc#1209507).
• CVE-2023-27530: Fixed a denial of service issue in multipart request parsing (bsc#1209096).

Non-security fixes:

• Fixed transactional update on GCE (bsc#1211398).
• Use HTTPS in rmt-client-setup-res (bsc#1209825).
• Various build fixes (bsc#1207670, bsc#1203171, bsc#1206593, bsc#1202053).

This update for rmt-server fixes the following issues:

Updated to version 2.13:

• CVE-2023-28120: Fixed a potential XSS issue in an embedded dependency (bsc#1209507).
• CVE-2023-27530: Fixed a denial of service issue in multipart request parsing (bsc#1209096).

Non-security fixes:

• Fixed transactional update on GCE (bsc#1211398).
• Use HTTPS in rmt-client-setup-res (bsc#1209825).
• Various build fixes (bsc#1207670, bsc#1203171, bsc#1206593, bsc#1202053).

This update for rmt-server fixes the following issues:

Update to version 2.13:

• CVE-2023-28120: Fixed a possible XSS Security Vulnerability in bytesliced strings for html_safe (bsc#1209507).
• CVE-2023-27530: Fixed a DoS in multipart mime parsing (bsc#1209096).
• CVE-2022-31254: Fixed escalation vector bug from user _rmt to root in the packaging file (bsc#1204285).

Bug fixes:

• Handle X-Original-URI header, partial fix for (bsc#1211398)
• Force rmt-client-setup-res script to use https (bsc#1209825)
• Mark secrets.yml.key file as part of the rpm to allow seamless downgrades (bsc#1207670)
• Adding -f to the file move command when moving the mirrored directory to its final location (bsc#1203171)
• Fix %post install of pubcloud subpackage reload of nginx (bsc#1206593)
• Skip warnings regarding nokogiri libxml version mismatch (bsc#1202053)
• Add option to turn off system token support (bsc#1205089)
• Do not retry to import non-existing files in air-gapped mode (bsc#1204769)

It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-27530)

It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126)

It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly use this issue to cause Rack to create large responses, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26141)

It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26146)

It was discovered that Rack incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2023-27539)

It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-27530)

It was discovered that Rack was not properly parsing data when processing multipart POST requests. If a user or automated system were tricked into sending a specially crafted multipart POST request to an application using Rack, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-30122)

It was discovered that Rack was not properly escaping untrusted data when performing logging operations, which could cause shell escaped sequences to be written to a terminal. If a user or automated system were tricked into sending a specially crafted request to an application using Rack, a remote attacker could possibly use this issue to execute arbitrary code in the machine running the application. (CVE-2022-30123)

It was discovered that Rack did not properly structure regular expressions in some of its parsing components, which could result in uncontrolled resource consumption if an application using Rack received specially crafted input. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-44570, CVE-2022-44571)

It was discovered that Rack did not properly structure regular expressions in its multipart parsing component, which could result in uncontrolled resource consumption if an application using Rack to parse multipart posts received specially crafted input. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-44572)

It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2023-27530)

It was discovered that Rack incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2023-27539)

It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126)

It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly use this issue to cause Rack to create large responses, leading to a denial of service. (CVE-2024-26141)

It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-26146)