Ruby/rack/2.0.1


Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

https://rubygems.org/gems/rack
MIT

28 Security Vulnerabilities

Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

Published date: 2024-02-28T22:57:26Z
CVE: CVE-2024-25126
Links:

Summary

module Rack
  class MediaType
    SPLIT_PATTERN = %r{\s*[;,]\s*}

The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split.

PoC

A simple HTTP request with lots of blank characters in the content-type header:

request["Content-Type"] = (" " * 50_000) + "a,"

Impact

It's a very easy to craft ReDoS. Like all ReDoS the impact is debatable.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "2.2.5", "2.2.6", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2", "2.2.6.3", "2.1.4.3", "2.0.9.3", "2.2.6.4", "2.2.7", "2.2.8", "2.1.4.4", "2.0.9.4", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.4.1", "3.0.4.2", "3.0.5", "3.0.6", "3.0.6.1", "3.0.7", "3.0.8", "3.0.9"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Rack has possible DoS Vulnerability in Multipart MIME parsing

Published date: 2023-03-08T17:20:04Z
CVE: CVE-2023-27530
Links:

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

Impact

The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

A proxy can be configured to limit the POST body size which will mitigate this issue.

Affected versions: ["3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.4.1", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.2.3.1", "2.2.4", "2.2.5", "2.2.6", "2.2.6.2", "2.2.6.1", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.1.4.1", "2.1.4.2", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.0.9.1", "2.0.9.2"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Rack Header Parsing leads to Possible Denial of Service Vulnerability

Published date: 2024-02-28T22:57:03Z
CVE: CVE-2024-26146
Links:

Possible Denial of Service Vulnerability in Rack Header Parsing

There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1

Impact

Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected.

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

  • 2-0-header-redos.patch - Patch for 2.0 series
  • 2-1-header-redos.patch - Patch for 2.1 series
  • 2-2-header-redos.patch - Patch for 2.2 series
  • 3-0-header-redos.patch - Patch for 3.0 series

Credits

Thanks to svalkanov for reporting this and providing patches!

Affected versions: ["2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.0.9.1", "2.0.9.2", "2.0.9.3", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.1.4.1", "2.1.4.2", "2.1.4.3", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.2.3.1", "2.2.4", "2.2.5", "2.2.6", "2.2.6.2", "2.2.6.1", "2.2.6.3", "2.2.6.4", "2.2.7", "2.2.8", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.4.1", "3.0.4.2", "3.0.5", "3.0.6", "3.0.6.1", "3.0.7", "3.0.8", "3.0.9"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Directory traversal in Rack::Directory app bundled with Rack

Published date: 2020-07-06T21:31:02Z
CVE: CVE-2020-8161
Links:

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

Affected versions: ["2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.0.9.1", "2.0.9.2", "2.0.9.3", "2.0.9.4"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Rack vulnerable to Cross-site Scripting

Published date: 2018-11-15T15:59:08Z
CVE: CVE-2018-16471
Links:

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.

Affected versions: ["1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of service via header parsing in Rack

Published date: 2023-01-18T18:19:33Z
CVE: CVE-2022-44570
Links:

There is a possible denial of service vulnerability in the Range header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44570.

Versions Affected: >= 1.5.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.0.1 Impact

Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted. Releases

The fixed releases are available at the normal locations. Workarounds

There are no feasible workarounds for this issue. Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

2-0-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.0 series
2-1-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.1 series
2-2-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.2 series
3-0-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 3.0 series

Affected versions: ["3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.2.3.1", "2.2.4", "2.2.5", "2.2.6", "2.2.6.1", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.1.4.1", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "2.0.9.1"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of Service Vulnerability in Rack Content-Disposition parsing

Published date: 2023-01-18T18:24:40Z
CVE: CVE-2022-44571
Links:

There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1 Impact

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Releases

The fixed releases are available at the normal locations. Workarounds

There are no feasible workarounds for this issue. Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series
2-1-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.1 series
2-2-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.2 series
3-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 3.0 series

Affected versions: ["3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.2.3.1", "2.2.4", "2.2.5", "2.2.6", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.1.4.1", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.9.1"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible Denial of Service Vulnerability in Rack's header parsing

Published date: 2023-03-15T21:36:02Z
CVE: CVE-2023-27539
Links:

There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1

Impact

Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.

Workarounds

Setting Regexp.timeout in Ruby 3.2 is a possible workaround.

Affected versions: ["3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.4.1", "3.0.4.2", "3.0.5", "3.0.6", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "2.2.5", "2.2.6", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2", "2.2.6.3", "2.1.4.3", "2.0.9.3", "2.1.4.4", "2.0.9.4"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible Information Leak / Session Hijack Vulnerability in Rack

Published date: 2019-12-18T19:01:31Z
CVE: CVE-2019-16782
Links:

There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.

The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Impact

The session id stored in a cookie is the same id that is used when querying the backing session storage engine. Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id. By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.

Releases

The 1.6.12 and 2.0.8 releases are available at the normal locations.

Workarounds

There are no known workarounds.

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

  • 1-6-session-timing-attack.patch - Patch for 1.6 series
  • 2-0-session-timing-attack.patch - Patch for 2.6 series

Credits

Thanks Will Leinweber for reporting this!

Affected versions: ["2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of Service Vulnerability in Rack Multipart Parsing

Published date: 2022-05-27T16:36:52Z
CVE: CVE-2022-30122
Links:

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122.

Versions Affected: >= 1.2 Not affected: < 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1

Impact

Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack's multipart parser to parse multipart posts. This includes directly using the multipart parser like this:

params = Rack::Multipart.parse_multipart(env)

But it also includes reading POST data from a Rack request object like this:

p request.POST # read POST data
p request.params # reads both query params and POST data

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

There are no feasible workarounds for this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

Published date: 2020-06-24T17:15:00Z
CVE: CVE-2020-8184
Links:

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.

Affected versions: ["2.2.2", "2.2.1", "2.2.0", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.0.9.1", "2.0.9.2", "2.0.9.3", "2.0.9.4"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of service via multipart parsing in Rack

Published date: 2023-01-18T18:19:21Z
CVE: CVE-2022-44572
Links:

There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1 Impact

Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Releases

The fixed releases are available at the normal locations. Workarounds

There are no feasible workarounds for this issue. Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series
2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series
2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series
3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series

Affected versions: ["3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.2.3.1", "2.2.4", "2.2.5", "2.2.6", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.1.4.1", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.9.1"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible shell escape sequence injection vulnerability in Rack

Published date: 2022-05-27T16:36:51Z
CVE: CVE-2022-30123
Links:

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1

Impact

Carefully crafted requests can cause shell escape sequences to be written to the terminal via Rack's Lint middleware and CommonLogger middleware. These escape sequences can be leveraged to possibly execute commands in the victim's terminal.

Impacted applications will have either of these middleware installed, and vulnerable apps may have something like this:

use Rack::Lint

Or

use Rack::CommonLogger

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

Remove these middleware from your application

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Rack has possible DoS Vulnerability with Range Header

Published date: 2024-02-28T22:57:12Z
CVE: CVE-2024-26141
Links:

Possible DoS Vulnerability with Range Header in Rack

There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.

Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1

Impact

Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.

Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications).

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

  • 3-0-range.patch - Patch for 3.0 series
  • 2-2-range.patch - Patch for 2.2 series

Credits

Thank you ooooooo_q for the report and patch

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "2.2.5", "2.2.6", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2", "2.2.6.3", "2.1.4.3", "2.0.9.3", "2.2.6.4", "2.2.7", "2.2.8", "2.1.4.4", "2.0.9.4", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.4.1", "3.0.4.2", "3.0.5", "3.0.6", "3.0.6.1", "3.0.7", "3.0.8", "3.0.9"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible XSS vulnerability in Rack

Published date: 2018-11-05
CVE: 2018-16471
CVSS V3: 6.1
Links:

There is a possible vulnerability in Rack. This vulnerability has been assigned the CVE identifier CVE-2018-16471.

Versions Affected: All. Not affected: None. Fixed Versions: 2.0.6, 1.6.11

Impact

There is a possible XSS vulnerability in Rack. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to http or https and do not escape the return value could be vulnerable to an XSS attack.

Vulnerable code looks something like this:

<%= request.scheme.html_safe %>

Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The 2.0.6 and 1.6.11 releases are available at the normal locations.

Workarounds

The following monkey patch can be applied to work around this issue:

require "rack"
require "rack/request"

class Rack::Request
SCHEME_WHITELIST = %w(https http).freeze

def scheme
  if get_header(Rack::HTTPS) == 'on'
    'https'
  elsif get_header(HTTP_X_FORWARDED_SSL) == 'on'
    'https'
  elsif forwarded_scheme
    forwarded_scheme
  else
    get_header(Rack::RACK_URL_SCHEME)
  end
end

def forwarded_scheme
  scheme_headers = [
    get_header(HTTP_X_FORWARDED_SCHEME),
    get_header(HTTP_X_FORWARDED_PROTO).to_s.split(',')[0]
  ]

  scheme_headers.each do |header|
    return header if SCHEME_WHITELIST.include?(header)
  end

  nil
end
end

Affected versions: ["2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible information leak / session hijack vulnerability

Published date: 2019-12-18
CVE: 2019-16782
CVSS V3: 6.3
Links:

There's a possible information leak / session hijack vulnerability in Rack.

Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.

The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Impact:

The session id stored in a cookie is the same id that is used when querying the backing session storage engine. Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id. By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.

Affected versions: ["2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Directory traversal in Rack::Directory app bundled with Rack

Published date: 2020-05-12
CVE: 2020-8161
CVSS V3: 8.6
Links:

There was a possible directory traversal vulnerability in the Rack::Directory app that is bundled with Rack.

Versions Affected: rack < 2.2.0 Not affected: Applications that do not use Rack::Directory. Fixed Versions: 2.1.3, >= 2.2.0

Impact

If certain directories exist in a director that is managed by Rack::Directory, an attacker could, using this vulnerability, read the contents of files on the server that were outside of the root specified in the Rack::Directory initializer.

Workarounds

Until such time as the patch is applied or their Rack version is upgraded, we recommend that developers do not use Rack::Directory in their applications.

Affected versions: ["2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.0.9.1", "2.0.9.2", "2.0.9.3", "2.0.9.4"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Percent-encoded cookies can be used to overwrite existing prefixed cookie names

Published date: 2020-06-15
CVE: 2020-8184
CVSS V3: 7.5
Links:

It is possible to forge a secure or host-only cookie prefix in Rack using an arbitrary cookie write by using URL encoding (percent-encoding) on the name of the cookie. This could result in an application that is dependent on this prefix to determine if a cookie is safe to process being manipulated into processing an insecure or cross-origin request. This vulnerability has been assigned the CVE identifier CVE-2020-8184.

Versions Affected: rack < 2.2.3, rack < 2.1.4 Not affected: Applications which do not rely on _Host- and _Secure- prefixes to determine if a cookie is safe to process Fixed Versions: rack >= 2.2.3, rack >= 2.1.4

Impact

An attacker may be able to trick a vulnerable application into processing an insecure (non-SSL) or cross-origin request if they can gain the ability to write arbitrary cookies that are sent to the application.

Workarounds

If your application is impacted but you cannot upgrade to the released versions or apply the provided patch, this issue can be temporarily addressed by adding the following workaround:

module Rack
  module Utils
    module_function def parse_cookies_header(header)
      return {} unless header
      header.split(/[;] */n).each_with_object({}) do |cookie, cookies|
        next if cookie.empty?
        key, value = cookie.split('=', 2)
        cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)
      end
    end
  end
end

Affected versions: ["2.2.2", "2.2.1", "2.2.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.0.9.1", "2.0.9.2", "2.0.9.3", "2.0.9.4"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of Service Vulnerability in Rack Multipart Parsing

Published date: 2022-06-27
CVE: 2022-30122
CVSS V3: 7.5
Links:

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122.

Versions Affected: >= 1.2 Not affected: < 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1

Impact

Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack's multipart parser to parse multipart posts. This includes directly using the multipart parser like this:

params = Rack::Multipart.parse_multipart(env)

But it also includes reading POST data from a Rack request object like this:

p request.POST # read POST data
p request.params # reads both query params and POST data

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

There are no feasible workarounds for this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible shell escape sequence injection vulnerability in Rack

Published date: 2022-06-27
CVE: 2022-30123
CVSS V3: 10.0
Links:

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1

Impact

Carefully crafted requests can cause shell escape sequences to be written to the terminal via Rack's Lint middleware and CommonLogger middleware. These escape sequences can be leveraged to possibly execute commands in the victim's terminal.

Impacted applications will have either of these middleware installed, and vulnerable apps may have something like this:

use Rack::Lint

Or

use Rack::CommonLogger

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

Remove these middleware from your application

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of service via header parsing in Rack

Published date: 2023-01-18
CVE: 2022-44570
CVSS V3: 7.5
Links:

There is a possible denial of service vulnerability in the Range header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44570.

Versions Affected: >= 1.5.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.4.1

Impact

Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Workarounds

There are no feasible workarounds for this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "3.0.0.beta1", "3.0.0.rc1", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "2.2.5", "3.0.4", "2.2.6", "2.2.6.1"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of Service Vulnerability in Rack Content-Disposition parsing

Published date: 2023-01-18
CVE: 2022-44571
Links:

There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1

Impact

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Workarounds

There are no feasible workarounds for this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "3.0.0.beta1", "3.0.0.rc1", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "2.2.5", "3.0.4", "2.2.6"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of service via multipart parsing in Rack

Published date: 2023-01-18
CVE: 2022-44572
Links:

There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1

Impact

Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Workarounds

There are no feasible workarounds for this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "3.0.0.beta1", "3.0.0.rc1", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "2.2.5", "3.0.4", "2.2.6"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible DoS Vulnerability in Multipart MIME parsing

Published date: 2023-03-03
CVE: 2023-27530
CVSS V3: 7.5
Links:

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

Impact

The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

A proxy can be configured to limit the POST body size which will mitigate this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "3.0.0.beta1", "3.0.0.rc1", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "2.2.5", "3.0.4", "2.2.6", "3.0.4.1", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible Denial of Service Vulnerability in Rack’s header parsing

Published date: 2023-03-13
CVE: 2023-27539
Links:

There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1

Impact

Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.

Workarounds

Setting Regexp.timeout in Ruby 3.2 is a possible workaround.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "3.0.0.beta1", "3.0.0.rc1", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "2.2.5", "3.0.4", "2.2.6", "3.0.4.1", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2", "3.0.4.2", "2.2.6.3", "2.1.4.3", "2.0.9.3", "3.0.5", "3.0.6", "2.1.4.4", "2.0.9.4"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Denial of Service Vulnerability in Rack Content-Type Parsing

Published date: 2024-02-21
CVE: 2024-25126
Links:

There is a possible denial of service vulnerability in the content type parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2024-25126.

Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions: 3.0.9.1, 2.2.8.1

Impact

Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack’s media type parser to parse content type headers. This code will look like below:

request.media_type

## OR
request.media_type_params

## OR
Rack::MediaType.type(content_type)

Some frameworks (including Rails) call this code internally, so upgrading is recommended!

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "3.0.0.beta1", "3.0.0.rc1", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "2.2.5", "3.0.4", "2.2.6", "3.0.4.1", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2", "3.0.4.2", "2.2.6.3", "2.1.4.3", "2.0.9.3", "3.0.5", "3.0.6", "3.0.6.1", "2.2.6.4", "3.0.7", "2.2.7", "3.0.8", "2.2.8", "3.0.9", "2.1.4.4", "2.0.9.4"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible DoS Vulnerability with Range Header in Rack

Published date: 2024-02-21
CVE: 2024-26141
Links:

There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.

Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1

Impact

Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.

Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications).

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "3.0.0.beta1", "3.0.0.rc1", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "2.2.5", "3.0.4", "2.2.6", "3.0.4.1", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2", "3.0.4.2", "2.2.6.3", "2.1.4.3", "2.0.9.3", "3.0.5", "3.0.6", "3.0.6.1", "2.2.6.4", "3.0.7", "2.2.7", "3.0.8", "2.2.8", "3.0.9", "2.1.4.4", "2.0.9.4"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

Possible Denial of Service Vulnerability in Rack Header Parsing

Published date: 2024-02-21
CVE: 2024-26146
Links:

There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1

Impact

Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected.

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Affected versions: ["2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0.beta2", "1.6.0.beta", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0.beta2", "1.3.0.beta", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.1", "1.0.0", "0.9.1", "0.9.0", "0.4.0", "0.3.0", "0.2.0", "0.1.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "3.0.0.beta1", "3.0.0.rc1", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "2.2.5", "3.0.4", "2.2.6", "3.0.4.1", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2", "3.0.4.2", "2.2.6.3", "2.1.4.3", "2.0.9.3", "3.0.5", "3.0.6", "3.0.6.1", "2.2.6.4", "3.0.7", "2.2.7", "3.0.8", "2.2.8", "3.0.9"]
Secure versions: [3.0.9.1, 2.2.8.1, 3.0.10, 2.2.9]
Recommendation: Update to version 3.0.10.

127 Other Versions

Version License Security Released
3.0.10 MIT 2024-03-20 - 21:57 8 days
3.0.9.1 MIT 2024-02-21 - 19:23 about 1 month
3.0.9 MIT 6 2024-01-31 - 07:52 about 2 months
3.0.8 MIT 6 2023-06-14 - 02:01 10 months
3.0.7 MIT 6 2023-03-16 - 02:22 about 1 year
3.0.6.1 MIT 6 2023-03-13 - 18:10 about 1 year
3.0.6 MIT 8 2023-03-13 - 06:00 about 1 year
3.0.5 MIT 8 2023-03-12 - 06:28 about 1 year
3.0.4.2 MIT 8 2023-03-02 - 22:57 about 1 year
3.0.4.1 MIT 10 2023-01-17 - 20:48 about 1 year
3.0.4 MIT 16 2023-01-16 - 22:41 about 1 year
3.0.3 MIT 16 2022-12-26 - 20:20 over 1 year
3.0.2 MIT 16 2022-12-05 - 05:13 over 1 year
3.0.1 MIT 16 2022-11-18 - 20:59 over 1 year
3.0.0 MIT 16 2022-09-06 - 16:28 over 1 year
3.0.0.rc1 MIT 8 2022-09-04 - 23:52 over 1 year
3.0.0.beta1 MIT 8 2022-08-08 - 20:34 over 1 year
2.2.9 MIT 2024-03-21 - 01:19 7 days
2.2.8.1 MIT 2024-02-21 - 19:23 about 1 month
2.2.8 MIT 6 2023-07-31 - 02:43 8 months
2.2.7 MIT 6 2023-04-24 - 23:22 11 months
2.2.6.4 MIT 6 2023-03-13 - 18:10 about 1 year
2.2.6.3 MIT 8 2023-03-02 - 22:57 about 1 year
2.2.6.2 MIT 10 2023-01-17 - 21:22 about 1 year
2.2.6.1 MIT 12 2023-01-17 - 20:48 about 1 year
2.2.6 MIT 16 2023-01-16 - 21:05 about 1 year
2.2.5 MIT 16 2022-12-26 - 20:19 over 1 year
2.2.4 MIT 16 2022-06-30 - 22:22 over 1 year
2.2.3.1 MIT 16 2022-05-27 - 15:31 almost 2 years
2.2.3 MIT 20 2020-06-15 - 22:25 almost 4 years
2.2.2 MIT 22 2020-02-10 - 22:25 about 4 years
2.2.1 MIT 22 2020-02-09 - 06:20 about 4 years
2.2.0 MIT 22 2020-02-08 - 18:26 about 4 years
2.1.4.4 MIT 6 2024-02-21 - 19:21 about 1 month
2.1.4.3 MIT 8 2023-03-02 - 22:57 about 1 year
2.1.4.2 MIT 10 2023-01-17 - 20:48 about 1 year
2.1.4.1 MIT 16 2022-05-27 - 15:31 almost 2 years
2.1.4 MIT 20 2020-06-15 - 22:24 almost 4 years
2.1.3 MIT 21 2020-05-12 - 21:44 almost 4 years
2.1.2 MIT 22 2020-01-27 - 22:42 about 4 years
2.1.1 MIT 22 2020-01-11 - 22:18 about 4 years
2.1.0 MIT 22 2020-01-10 - 17:49 about 4 years
2.0.9.4 MIT 10 2024-02-21 - 19:20 about 1 month
2.0.9.3 MIT 12 2023-03-02 - 22:57 about 1 year
2.0.9.2 MIT 14 2023-01-17 - 20:48 about 1 year
2.0.9.1 MIT 20 2022-05-27 - 15:31 almost 2 years
2.0.9 MIT 24 2020-02-08 - 18:21 about 4 years
2.0.8 MIT 24 2019-12-18 - 18:08 over 4 years
2.0.7 MIT 26 2019-04-02 - 16:54 almost 5 years
2.0.6 MIT 26 2018-11-05 - 20:00 over 5 years
2.0.5 MIT 30 2018-04-23 - 17:47 almost 6 years
2.0.4 MIT 30 2018-01-31 - 18:17 about 6 years
2.0.3 MIT 28 2017-05-15 - 16:50 almost 7 years
2.0.2 MIT 28 2017-05-08 - 17:08 almost 7 years
2.0.1 MIT 28 2016-06-30 - 17:34 over 7 years
2.0.0.rc1 MIT 23 2016-05-06 - 20:52 almost 8 years
2.0.0.alpha MIT 23 2015-12-17 - 21:34 over 8 years
1.6.13 MIT 21 2020-02-08 - 18:19 about 4 years
1.6.12 MIT 21 2019-12-18 - 18:08 over 4 years
1.6.11 MIT 22 2018-11-05 - 20:00 over 5 years
1.6.10 MIT 23 2018-04-23 - 17:52 almost 6 years
1.6.9 MIT 23 2018-02-27 - 17:19 about 6 years
1.6.8 MIT 23 2017-05-16 - 21:29 almost 7 years
1.6.7 MIT 23 2017-05-15 - 16:47 almost 7 years
1.6.6 MIT 23 2017-05-08 - 17:07 almost 7 years
1.6.5 MIT 23 2016-11-10 - 21:55 over 7 years
1.6.4 MIT 23 2015-06-18 - 21:51 almost 9 years
1.6.3 MIT 23 2015-06-18 - 18:45 almost 9 years
1.6.2 MIT 23 2015-06-16 - 17:59 almost 9 years
1.6.1 MIT 26 2015-05-06 - 18:37 almost 9 years
1.6.0 MIT 26 2014-12-18 - 22:45 over 9 years
1.6.0.beta2 MIT 24 2014-11-27 - 18:52 over 9 years
1.6.0.beta MIT 24 2014-08-18 - 19:02 over 9 years
1.5.5 MIT 25 2015-06-18 - 18:46 almost 9 years
1.5.4 MIT 25 2015-06-16 - 17:58 almost 9 years
1.5.3 MIT 27 2015-05-06 - 18:43 almost 9 years
1.5.2 MIT 27 2013-02-08 - 03:14 about 11 years
1.5.1 UNKNOWN 31 2013-01-28 - 22:52 about 11 years
1.5.0 UNKNOWN 31 2013-01-22 - 07:40 about 11 years
1.5.0.beta.2 UNKNOWN 26 2013-01-13 - 22:10 about 11 years
1.5.0.beta.1 UNKNOWN 26 2013-01-11 - 22:58 about 11 years
1.4.7 UNKNOWN 24 2015-06-18 - 21:12 almost 9 years
1.4.6 UNKNOWN 24 2015-06-16 - 20:47 almost 9 years
1.4.5 UNKNOWN 26 2013-02-08 - 03:13 about 11 years
1.4.4 UNKNOWN 28 2013-01-13 - 22:07 about 11 years
1.4.3 UNKNOWN 30 2013-01-07 - 18:49 about 11 years
1.4.2 UNKNOWN 32 2013-01-07 - 02:43 about 11 years
1.4.1 UNKNOWN 34 2012-01-23 - 06:51 about 12 years
1.4.0 UNKNOWN 34 2011-12-28 - 02:56 about 12 years
1.3.10 UNKNOWN 27 2013-02-08 - 03:11 about 11 years
1.3.9 UNKNOWN 28 2013-01-13 - 22:07 about 11 years
1.3.8 UNKNOWN 29 2013-01-07 - 18:49 about 11 years
1.3.7 UNKNOWN 30 2013-01-07 - 02:42 about 11 years
1.3.6 UNKNOWN 31 2011-12-28 - 02:52 about 12 years
1.3.5 UNKNOWN 32 2011-10-18 - 05:33 over 12 years
1.3.4 UNKNOWN 32 2011-10-01 - 20:50 over 12 years
1.3.3 UNKNOWN 32 2011-09-16 - 23:32 over 12 years
1.3.2 UNKNOWN 32 2011-07-26 - 01:40 over 12 years
1.3.1 UNKNOWN 32 2011-07-13 - 23:20 over 12 years
1.3.0 UNKNOWN 32 2011-05-23 - 06:08 almost 13 years