{"id":"CVE-2022-30123","aliases":["DEBIAN-CVE-2022-30123","DLA-3095-1","DSA-5530-1","EUVD-2022-5620","GHSA-wq4h-7r42-5hrr","MGASA-2022-0252","OESA-2022-1729","RHSA-2022:7343","RHSA-2023:1486","SUSE-SU-2022:2192-1","SUSE-SU-2022:2526-1","UBUNTU-CVE-2022-30123","USN-5253-1","USN-5896-1","USN-7036-1","openSUSE-SU-2024:12119-1","openSUSE-SU-2024:12397-1","openSUSE-SU-2024:12974-1","openSUSE-SU-2024:13167-1","openSUSE-SU-2024:13726-1","openSUSE-SU-2024:13727-1","openSUSE-SU-2025:14811-1","openSUSE-SU-2025:14875-1","openSUSE-SU-2026:10286-1","openSUSE-SU-2026:10358-1"],"status":"published","title":"Possible shell escape sequence injection vulnerability in Rack","description":"A sequence injection vulnerability exists in Rack \u003c2.0.9.1, \u003c2.1.4.1 and \u003c2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01955,"percentile":0.8041,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-150"],"published":"2022-05-27T16:36:51Z","modified":"2026-11-03T08:02:19Z","fixes":[{"ecosystem":"RubyGems","package":"rack","fixed_in":["2.0.9.1","2.1.4.1","2.2.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-rack","fixed_in":["2.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-rack","fixed_in":["2.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rack","fixed_in":["2.2.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-rack","fixed_in":["1.5.2-3+deb8u3ubuntu1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-rack","fixed_in":["1.6.4-3ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","fixed_in":["1.6.4-4ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","fixed_in":["2.0.7-2ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","fixed_in":["2.1.4-5ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","fixed_in":["2.1.4-5ubuntu1+esm2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.9.0"},{"fixed":"2.0.9.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"last_affected":"2.1.4.0"},{"fixed":"2.1.4.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"last_affected":"2.2.3.0"},{"fixed":"2.2.3.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-3+deb10u1"}]}],"versions":["2.0.6-3"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-3+deb11u1"}]}],"versions":["2.1.4-3"],"bundled":7},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9.1"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.1.1","1.1.1.pre","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.3.0","1.3.0.beta","1.3.0.beta2","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0.beta","1.6.0.beta2","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","2.0.0.alpha","2.0.0.rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"fixed":"2.1.4.1"}]}],"versions":["2.1.0","2.1.1","2.1.2","2.1.3","2.1.4"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"fixed":"2.2.3.1"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3"]},{"source":"osv","ecosystem":"Mageia:8","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-1.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-1.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-1.oe2203"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.169-3.el7_9.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pcs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.169-3.el7_9.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.169-3.el7_9.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.5:wa:el7","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.12-1.el7rhgs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:storage:3.5:wa:el7","package":"rubygem-puma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.12-1.el7rhgs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:storage:3.5:wa:el7","package":"rubygem-puma-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.12-1.el7rhgs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:storage:3.5:wa:el7","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.4-1.el7rhgs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:storage:3.5:wa:el7","package":"rubygem-rack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.4-1.el7rhgs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:storage:3.5:wa:el7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.4-6.el7rhgs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:storage:3.5:wa:el7","package":"rubygem-tzinfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.el7rhgs"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:storage:3.5:wa:el7","package":"rubygem-tzinfo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.el7rhgs"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-3.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-3.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-3+deb8u3ubuntu1~esm4"}]}],"versions":["1.5.2-1","1.5.2-1ubuntu0.1~esm1","1.5.2-3+deb8u3ubuntu1~esm2","1.5.2-3+deb8u3ubuntu1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu0.2+esm2"}]}],"versions":["1.5.2-4","1.6.4-2","1.6.4-3","1.6.4-3ubuntu0.1","1.6.4-3ubuntu0.2","1.6.4-3ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-4ubuntu0.2+esm2"}]}],"versions":["1.6.4-4","1.6.4-4ubuntu0.1","1.6.4-4ubuntu0.2","1.6.4-4ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm2"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1","2.0.7-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1.1"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1+esm2"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-3+deb8u3ubuntu1~esm4"}]}],"versions":["1.5.2-1","1.5.2-1ubuntu0.1~esm1","1.5.2-3+deb8u3ubuntu1~esm2","1.5.2-3+deb8u3ubuntu1~esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu0.2+esm2"}]}],"versions":["1.5.2-4","1.6.4-2","1.6.4-3","1.6.4-3ubuntu0.1","1.6.4-3ubuntu0.2","1.6.4-3ubuntu0.2+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-4ubuntu0.2+esm1"}]}],"versions":["1.6.4-4","1.6.4-4ubuntu0.1","1.6.4-4ubuntu0.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm1"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-4ubuntu0.2+esm2"}]}],"versions":["1.6.4-4","1.6.4-4ubuntu0.1","1.6.4-4ubuntu0.2","1.6.4-4ubuntu0.2+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm2"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1","2.0.7-2ubuntu0.1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1+esm2"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1.1"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1.2"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-1.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-1.3"}]}],"bundled":18}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rack_project","product":"rack"}],"references":[{"url":"https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://www.debian.org/security/2023/dsa-5530","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202310-18","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231208-0011/","tags":["x_transferred","advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30123.yml","tags":["web","advisory"]},{"url":"https://groups.google.com/g/ruby-security-ann/c/LWB10kWzag8","tags":["web","report"]},{"url":"https://github.com/rack/rack/commit/b426cc224908ec6ed6eb8729325392b048215d88","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30123","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wq4h-7r42-5hrr","tags":["advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30123.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-30123","tags":["advisory"]},{"url":"https://github.com/rack/rack","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20231208-0011","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0252.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30584","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YUVA3VLO4OV257BQFK2XW3NHYOE2V7GX/","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30122.yml","tags":["advisory","article"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8184","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7343","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1701972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2099524","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7343.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11358","tags":["advisory"]},{"url":"https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/","tags":["article"]},{"url":"https://www.drupal.org/sa-core-2019-006","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11023","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30123","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30123","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1486","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2071616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2099519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105075","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110551","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1486.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24790","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24790","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30122","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31129","tags":["advisory"]},{"url":"https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31163","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31163","tags":["advisory"]},{"url":"https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222192-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200748","tags":["report"]},{"url":"https://bugzilla.suse.com/1200750","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30123","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222526-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30123","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5253-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5896-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7036-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-16782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-25126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26146","tags":["report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/ruby-rack/+bug/2078711","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26146","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FLQ74D2IZAJC5KD6QXVUZAQ6O5LNAWZX/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25184","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MOZFATD6SCQREBY3SZW5KQJPN6KN7A6D/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25500","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-30123","description":"A sequence injection vulnerability exists in Rack \u003c2.0.9.1, \u003c2.1.4.1 and \u003c2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2024-08-03T06:40:47.582Z","cwes":["CWE-150"],"updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-5620","description":"A sequence injection vulnerability exists in Rack \u003c2.0.9.1, \u003c2.1.4.1 and \u003c2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2024-08-03T06:40:47Z","updated_at":"2026-11-03T03:25:36.95433Z"}],"ghsa":[{"id":"GHSA-wq4h-7r42-5hrr","title":"Possible shell escape sequence injection vulnerability in Rack","description":"There is a possible shell escape sequence injection vulnerability in the Lint\nand CommonLogger components of Rack.  This vulnerability has been assigned the\nCVE identifier CVE-2022-30123.\n\nVersions Affected:  All.\nNot affected:       None\nFixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1\n\n## Impact\nCarefully crafted requests can cause shell escape sequences to be written to\nthe terminal via Rack's Lint middleware and CommonLogger middleware.  These\nescape sequences can be leveraged to possibly execute commands in the victim's\nterminal.\n\nImpacted applications will have either of these middleware installed, and\nvulnerable apps may have something like this:\n\n```\nuse Rack::Lint\n```\n\nOr\n\n```\nuse Rack::CommonLogger\n```\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\n## Workarounds\nRemove these middleware from your application\n","status":"published","published":"2022-05-27T16:36:51Z","modified":"2023-12-17T05:05:18Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:37:26.727664Z"}],"nvd":[{"id":"CVE-2022-30123","description":"A sequence injection vulnerability exists in Rack \u003c2.0.9.1, \u003c2.1.4.1 and \u003c2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.","status":"published","published":"2022-12-05T22:15:10.28Z","modified":"2026-06-17T04:43:04.987Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"DEBIAN-CVE-2022-30123","description":"A sequence injection vulnerability exists in Rack \u003c2.0.9.1, \u003c2.1.4.1 and \u003c2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.","status":"published","published":"2022-12-05T22:15:10.28Z","modified":"2026-11-03T08:02:19.409228014Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"GHSA-wq4h-7r42-5hrr","title":"Possible shell escape sequence injection vulnerability in Rack","description":"There is a possible shell escape sequence injection vulnerability in the Lint\nand CommonLogger components of Rack.  This vulnerability has been assigned the\nCVE identifier CVE-2022-30123.\n\nVersions Affected:  All.\nNot affected:       None\nFixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1\n\n## Impact\nCarefully crafted requests can cause shell escape sequences to be written to\nthe terminal via Rack's Lint middleware and CommonLogger middleware.  These\nescape sequences can be leveraged to possibly execute commands in the victim's\nterminal.\n\nImpacted applications will have either of these middleware installed, and\nvulnerable apps may have something like this:\n\n```\nuse Rack::Lint\n```\n\nOr\n\n```\nuse Rack::CommonLogger\n```\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\n## Workarounds\nRemove these middleware from your application\n","status":"published","published":"2022-05-27T16:36:51Z","modified":"2024-02-18T05:41:38.830363Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"OESA-2022-1729","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nDenial of Service Vulnerability in Rack Multipart Parsing(CVE-2022-30122)\r\n\r\nPossible shell escape sequence injection vulnerability in Rack(CVE-2022-30123)\r\n\r\nA reliance on cookies without validation/integrity check security vulnerability exists in rack \u0026lt; 2.2.3, rack \u0026lt; 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.(CVE-2020-8184)","status":"published","published":"2022-07-01T11:05:00Z","modified":"2026-08-18T01:16:43.75120543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:7343","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-18T04:28:41Z","modified":"2026-10-08T10:03:07Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:1486","title":"Red Hat Security Advisory: Red Hat Gluster Storage web-admin-build security update","status":"published","published":"2024-09-30T14:42:50Z","modified":"2026-10-13T10:03:57Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"UBUNTU-CVE-2022-30123","description":"A sequence injection vulnerability exists in Rack \u003c2.0.9.1, \u003c2.1.4.1 and \u003c2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.","status":"published","published":"2022-12-05T22:15:00Z","modified":"2026-02-04T02:34:59.800445Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CVE-2022-30123","description":"A sequence injection vulnerability exists in Rack \u003c2.0.9.1, \u003c2.1.4.1 and \u003c2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2026-10-28T02:30:35.088422799Z","cwes":["CWE-150"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"DLA-3095-1","title":"ruby-rack - security update","status":"published","published":"2022-09-04T00:00:00Z","modified":"2026-03-09T01:21:07.010918Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5530-1","title":"ruby-rack - security update","status":"published","published":"2023-10-22T00:00:00Z","modified":"2026-03-09T02:10:56.129859Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2022-0252","title":"Updated ruby-rack packages fix security vulnerability","description":"Crafted multipart POST request may cause a DoS (CVE-2022-30122)\nCrafted requests can cause shell escape sequences (CVE-2022-30123)\n","status":"published","published":"2022-07-05T19:11:26Z","modified":"2026-04-16T04:41:53.894782918Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12119-1","title":"ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rack-2.2.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:41:57.98501Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12397-1","title":"ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:09.934016Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12974-1","title":"ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rack-2.2-2.2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:21.929927Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13167-1","title":"ruby3.2-rubygem-rack-3.0.7-1.2 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rack-3.0.7-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:45.897529Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13726-1","title":"ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:59.579529Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13727-1","title":"ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:46.684926Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:14811-1","title":"ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2026-02-04T04:22:14.520853Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14875-1","title":"ruby3.4-rubygem-rack-3.1.12-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-11T00:00:00Z","modified":"2025-05-07T18:08:49.787747Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10286-1","title":"ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-04T00:00:00Z","modified":"2026-03-23T04:54:39.054152Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10358-1","title":"ruby4.0-rubygem-rack-3.1.18-1.3 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:26:09.361493Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2022:2192-1","title":"Security update for rubygem-rack","description":"This update for rubygem-rack fixes the following issues:\n\n- CVE-2022-30122: Fixed crafted multipart POST request may cause a DoS (bsc#1200748)\n- CVE-2022-30123: Fixed crafted requests can cause shell escape sequences (bsc#1200750)\n","status":"published","published":"2022-06-27T15:13:56Z","modified":"2026-02-04T04:38:39.92321Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2526-1","title":"Security update for rubygem-rack","description":"This update for rubygem-rack fixes the following issues:\n\n- CVE-2022-30122: Fixed crafted multipart POST request may cause a DoS (bsc#1200748)\n- CVE-2022-30123: Fixed crafted requests can cause shell escape sequences (bsc#1200750)\n\nThe following non-security bug was fixed:\n\n- Fixed a regression in CVE-2022-30122 patch (bsc#1201588).\n","status":"published","published":"2022-07-22T08:41:50Z","modified":"2026-02-04T03:39:17.984992Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5253-1","title":"ruby-rack vulnerabilities","description":"It was discovered that Rack insecurely handled session ids. An\nunauthenticated remote attacker could possibly use this issue to perform\na timing attack and hijack sessions. (CVE-2019-16782)\n\nIt was discovered that Rack was incorrectly handling cookies during\nparsing, not validating them or performing the necessary integrity checks.\nAn attacker could possibly use this issue to overwrite existing cookie\ndata and gain control over a remote system's behaviour. This issue only\naffected Ubuntu 14.04 ESM. (CVE-2020-8184)\n\nIt was discovered that Rack was not properly parsing data when processing\nmultipart POST requests. If a user or automated system were tricked into\nsending a specially crafted multipart POST request to an application using\nRack, a remote attacker could possibly use this issue to cause a denial of\nservice. This issue was only fixed in Ubuntu 14.04 ESM and Ubuntu 16.04\nESM. (CVE-2022-30122)\n\nIt was discovered that Rack was not properly escaping untrusted data when\nperforming logging operations, which could cause shell escaped sequences\nto be written to a terminal. If a user or automated system were tricked\ninto sending a specially crafted request to an application using Rack, a\nremote attacker could possibly use this issue to execute arbitrary code in\nthe machine running the application. This issue was only fixed in Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2022-30123)\n","status":"published","published":"2022-12-13T11:33:52Z","modified":"2026-06-29T13:49:35.399588967Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5896-1","title":"ruby-rack vulnerabilities","description":"It was discovered that Rack was not properly parsing data when processing\nmultipart POST requests. If a user or automated system were tricked into\nsending a specially crafted multipart POST request to an application using\nRack, a remote attacker could possibly use this issue to cause a denial of\nservice. (CVE-2022-30122)\n\nIt was discovered that Rack was not properly escaping untrusted data when\nperforming logging operations, which could cause shell escaped sequences\nto be written to a terminal. If a user or automated system were tricked\ninto sending a specially crafted request to an application using Rack, a\nremote attacker could possibly use this issue to execute arbitrary code in\nthe machine running the application. (CVE-2022-30123)\n","status":"published","published":"2023-02-27T18:25:06Z","modified":"2026-02-10T04:42:58Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-7036-1","title":"ruby-rack vulnerabilities","description":"It was discovered that Rack was not properly parsing data when processing\nmultipart POST requests. If a user or automated system were tricked into\nsending a specially crafted multipart POST request to an application using\nRack, a remote attacker could possibly use this issue to cause a denial of\nservice. (CVE-2022-30122)\n\nIt was discovered that Rack was not properly escaping untrusted data when\nperforming logging operations, which could cause shell escaped sequences\nto be written to a terminal. If a user or automated system were tricked\ninto sending a specially crafted request to an application using Rack, a\nremote attacker could possibly use this issue to execute arbitrary code in\nthe machine running the application. (CVE-2022-30123)\n\nIt was discovered that Rack did not properly structure regular expressions\nin some of its parsing components, which could result in uncontrolled\nresource consumption if an application using Rack received specially\ncrafted input. A remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2022-44570, CVE-2022-44571)\n\nIt was discovered that Rack did not properly structure regular expressions\nin its multipart parsing component, which could result in uncontrolled\nresource consumption if an application using Rack to parse multipart posts\nreceived specially crafted input. A remote attacker could possibly use\nthis issue to cause a denial of service. (CVE-2022-44572)\n\nIt was discovered that Rack incorrectly handled Multipart MIME parsing.\nA remote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2023-27530)\n\nIt was discovered that Rack incorrectly handled certain regular\nexpressions. A remote attacker could possibly use this issue to cause\nRack to consume resources, leading to a denial of service.\n(CVE-2023-27539)\n\nIt was discovered that Rack incorrectly parsed certain media types. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2024-25126)\n\nIt was discovered that Rack incorrectly handled certain Range headers. A\nremote attacker could possibly use this issue to cause Rack to create\nlarge responses, leading to a denial of service. (CVE-2024-26141)\n\nIt was discovered that Rack incorrectly handled certain crafted headers. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2024-26146)\n","status":"published","published":"2024-09-26T04:19:46Z","modified":"2026-02-10T04:45:27Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}