CVE-2023-27530 Rack has possible DoS Vulnerability in Multipart MIME parsing

Q: Which versions are affected by CVE-2023-27530?

8 open source packages ship an affected version, including rack. It affects 2 products.

Q: Is CVE-2023-27530 being exploited?

There is no known exploitation of CVE-2023-27530 in the wild and no public exploit code.

Q: How do I fix CVE-2023-27530?

Upgrade rack to a fixed version for your release line: 2.0.9.3, 2.1.4.3, 2.2.6.3 or 3.0.4.2.

High 7.5 Published 10 Mar 2023 Updated 15 Oct 2024

Attackers can cause denial of service by crafting requests that exploit inefficient multipart MIME parsing in the Rack library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-27530?

CVE-2023-27530 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 10 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

Weakness: CWE-770, CWE-400

Which versions are affected by CVE-2023-27530?

8 open source packages ship an affected version, including rack. It affects 2 products.

Package	Affected	Fixed in
`rack` RubyGems	All versions	`2.0.9.3`
`rack` RubyGems	All versions	`2.0.9.3`
`rack` RubyGems	From `2.1.0`	`2.1.4.3`
`rack` RubyGems	From `2.1.0`	`2.1.4.3`
`rack` RubyGems	From `2.2.0`	`2.2.6.3`
`rack` RubyGems	From `2.2.0`	`2.2.6.3`

2 more packages

`rack` RubyGems	From `3.0.0`	`3.0.4.2`
`rack` RubyGems	From `3.0.0`	`3.0.4.2`

Linux distribution packages (7)

`rubygem-rack` SUSE:Linux Enterprise High Availability Extension 15 SP1	All versions	`2.0.8-150000.3.15.1`
`rubygem-rack` SUSE:Linux Enterprise High Availability Extension 15 SP2	All versions	`2.0.8-150000.3.15.1`
`rubygem-rack` SUSE:Linux Enterprise High Availability Extension 15 SP3	All versions	`2.0.8-150000.3.15.1`
`rubygem-rack` SUSE:Linux Enterprise High Availability Extension 15 SP4	All versions	`2.0.8-150000.3.15.1`
`rubygem-rack` openSUSE:Leap 15.4	All versions	`2.0.8-150000.3.15.1`
`rubygem-rack` openSUSE:Tumbleweed	All versions	`2.2.6.3-1.1`
`rubygem-rack` openSUSE:Tumbleweed	All versions	`3.0.4.2-1.1`

Products include Debian Debian Linux, Rack Rack.

How do I fix CVE-2023-27530?

Upgrade rack to a fixed version for your release line: 2.0.9.3, 2.1.4.3, 2.2.6.3 or 3.0.4.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-27530 being exploited?

There is no known exploitation of CVE-2023-27530 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-27530, GHSA-3h57-hmj3-gj3p, SUSE-SU-2023:0725-1, UBUNTU-CVE-2023-27530, openSUSE-SU-2024:12773-1, openSUSE-SU-2024:12784-1.