UBUNTU-CVE-2024-26146

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-26146

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-26146.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-26146

Related

Published

2024-02-29T00:15:00Z

Modified

2024-10-15T14:12:55Z

Summary

[none]

Details

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

References

Affected packages

Ubuntu:Pro:14.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.2-3+deb8u3ubuntu1~esm8

Affected versions

1.*

1.5.2-1

1.5.2-1ubuntu0.1~esm1

1.5.2-3+deb8u3ubuntu1~esm2

1.5.2-3+deb8u3ubuntu1~esm3

1.5.2-3+deb8u3ubuntu1~esm4

1.5.2-3+deb8u3ubuntu1~esm6

1.5.2-3+deb8u3ubuntu1~esm7

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm8",
            "binary_name": "librack-ruby"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm8",
            "binary_name": "librack-ruby1.8"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm8",
            "binary_name": "librack-ruby1.9.1"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm8",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.4-3ubuntu0.2+esm6

Affected versions

1.*

1.5.2-4

1.6.4-2

1.6.4-3

1.6.4-3ubuntu0.1

1.6.4-3ubuntu0.2

1.6.4-3ubuntu0.2+esm1

1.6.4-3ubuntu0.2+esm2

1.6.4-3ubuntu0.2+esm4

1.6.4-3ubuntu0.2+esm5

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.6.4-3ubuntu0.2+esm6",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.4-4ubuntu0.2+esm6

Affected versions

1.*

1.6.4-4

1.6.4-4ubuntu0.1

1.6.4-4ubuntu0.2

1.6.4-4ubuntu0.2+esm1

1.6.4-4ubuntu0.2+esm2

1.6.4-4ubuntu0.2+esm4

1.6.4-4ubuntu0.2+esm5

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.6.4-4ubuntu0.2+esm6",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:20.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.6-3

2.0.7-2

2.0.7-2ubuntu0.1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:20.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.7-2ubuntu0.1+esm5

Affected versions

2.*

2.0.6-3

2.0.7-2

2.0.7-2ubuntu0.1

2.0.7-2ubuntu0.1+esm1

2.0.7-2ubuntu0.1+esm2

2.0.7-2ubuntu0.1+esm3

2.0.7-2ubuntu0.1+esm4

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.0.7-2ubuntu0.1+esm5",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:22.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.4-5ubuntu1.1

Affected versions

2.*

2.1.4-3

2.1.4-4

2.1.4-5

2.1.4-5ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.1.4-5ubuntu1.1",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:22.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.4-5ubuntu1+esm5

Affected versions

2.*

2.1.4-3

2.1.4-4

2.1.4-5

2.1.4-5ubuntu1

2.1.4-5ubuntu1+esm2

2.1.4-5ubuntu1+esm3

2.1.4-5ubuntu1+esm4

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.1.4-5ubuntu1+esm5",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:24.10 / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.7-1.1

Affected versions

2.*

2.2.7-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.2.7-1.1",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:24.04:LTS / ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.7-1ubuntu0.1

Affected versions

2.*

2.2.4-3

2.2.7-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.2.7-1ubuntu0.1",
            "binary_name": "ruby-rack"
        }
    ]
}