Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 14 Jan 2013 17:20:15 -0700
From: Vincent Danen <>
Subject: CVE request: 3 DoS conditions in Rake

Three issues were noted in recent release of upstream Rake.  All are DoS

 From (2 issues):

Upstream released [1] Rack 1.4.2, 1.3.7, 1.2.6, and 1.1.4 to fix a
denial of service condition when Rack parses content with a certain
Content-Disposition header as noted in the original report [2].

This has been fixed in git [3].

Additionally, a second flaw that was fixed in 1.4.4, 1.3.9, 1.2.7, and
1.1.5 was also announced [4] that creates a minor denial of service
condition, this time in the Rack::Auth::AbstractRequest, where it
symbolized arbitrary strings (apparently this has something to do with
authentication, but there is no further information provided other than
the fix [5] itself, which is noted as "a breaking API change").


And from

Upstream released [1] Rack 1.4.3 and 1.3.8 to fix a denial of service
condition due to a malicious client sending excessively long lines that
trigger an out-of-memory error in Rack.

This has been fixed in git [2].


Could three CVEs be assigned for these issues please?  Thanks.

Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.