Skip to content

Commit 1f5c25f

Browse files
jasnowpostmodern
jasnow
authored and
postmodern
committed
GHSA SYNC: 3 brand new advisories
1 parent 4b71fa5 commit 1f5c25f

File tree

3 files changed

+168
-0
lines changed

3 files changed

+168
-0
lines changed

‎gems/rack-session/CVE-2025-46336.yml

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
gem: rack-session
3+
cve: 2025-46336
4+
ghsa: 9j94-67jr-4cqj
5+
url: https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
6+
title: Rack session gets restored after deletion
7+
date: 2025-05-08
8+
description: |
9+
## Summary
10+
11+
When using the `Rack::Session::Pool` middleware, simultaneous rack
12+
requests can restore a deleted rack session, which allows the
13+
unauthenticated user to occupy that session.
14+
15+
## Details
16+
17+
[Rack session middleware](https://github.com/rack/rack-session/blob/v2.1.0/lib/rack/session/abstract/id.rb#L271-L278)
18+
prepares the session at the beginning of request, then saves is back
19+
to the store with possible changes applied by host rack application.
20+
This way the session becomes to be a subject of race conditions in
21+
general sense over concurrent rack requests.
22+
23+
## Impact
24+
25+
When using the `Rack::Session::Pool` middleware, and provided the
26+
attacker can acquire a session cookie (already a major issue), the
27+
session may be restored if the attacker can trigger a long running
28+
request (within that same session) adjacent to the user logging out,
29+
in order to retain illicit access even after a user has attempted to logout.
30+
31+
## Mitigation
32+
33+
- Update to the latest version of `rack-session`, or
34+
- Ensure your application invalidates sessions atomically by marking
35+
them as logged out e.g., using a `logged_out` flag, instead of
36+
deleting them, and check this flag on every request to prevent reuse, or
37+
- Implement a custom session store that tracks session invalidation
38+
timestamps and refuses to accept session data if the session was
39+
invalidated after the request began.
40+
41+
## Related
42+
43+
This code was previously part of `rack` in Rack < 3, see
44+
<https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g>
45+
for the equivalent advisory in `rack` (affecting Rack < 3 only).
46+
cvss_v3: 4.2
47+
unaffected_versions:
48+
- "< 2.0.0"
49+
patched_versions:
50+
- ">= 2.1.1"
51+
related:
52+
ghsa:
53+
- https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g
54+
url:
55+
- https://nvd.nist.gov/vuln/detail/CVE-2025-46336
56+
- https://github.com/rack/rack-session/commit/c28c4a8c1861d814e09f2ae48264ac4c40be2d3b
57+
- https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
58+
- https://github.com/advisories/GHSA-9j94-67jr-4cqj

‎gems/rack/CVE-2025-32441.yml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
gem: rack
3+
cve: 2025-32441
4+
ghsa: vpfw-47h7-xj4g
5+
url: https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
6+
title: Rack session gets restored after deletion
7+
date: 2025-05-08
8+
description: |
9+
### Summary
10+
11+
When using the `Rack::Session::Pool` middleware, simultaneous rack
12+
requests can restore a deleted rack session, which allows the
13+
unauthenticated user to occupy that session.
14+
15+
### Details
16+
17+
[Rack session middleware](https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270)
18+
prepares the session at the beginning of request, then saves is back
19+
to the store with possible changes applied by host rack application.
20+
This way the session becomes to be a subject of race conditions in
21+
general sense over concurrent rack requests.
22+
23+
### Impact
24+
25+
When using the `Rack::Session::Pool` middleware, and provided the
26+
attacker can acquire a session cookie (already a major issue), the
27+
session may be restored if the attacker can trigger a long running
28+
request (within that same session) adjacent to the user logging out,
29+
in order to retain illicit access even after a user has attempted to logout.
30+
31+
## Mitigation
32+
33+
- Update to the latest version of `rack`, or
34+
- Ensure your application invalidates sessions atomically by marking
35+
them as logged out e.g., using a `logged_out` flag, instead of
36+
deleting them, and check this flag on every request to prevent reuse, or
37+
- Implement a custom session store that tracks session invalidation
38+
timestamps and refuses to accept session data if the session was
39+
invalidated after the request began.
40+
41+
### Related
42+
43+
As this code was moved to `rack-session` in Rack 3+, see
44+
<https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj>
45+
for the equivalent advisory in `rack-session` (affecting Rack 3+ only).
46+
cvss_v3: 4.2
47+
patched_versions:
48+
- ">= 2.2.14"
49+
related:
50+
ghsa:
51+
- https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
52+
url:
53+
- https://nvd.nist.gov/vuln/detail/CVE-2025-32441
54+
- https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g
55+
- https://github.com/rack/rack/commit/c48e52f7c57e99e1e1bf54c8760d4f082cd1c89d
56+
- https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270
57+
- https://github.com/advisories/GHSA-vpfw-47h7-xj4g

‎gems/rack/CVE-2025-46727.yml

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
gem: rack
3+
cve: 2025-46727
4+
ghsa: gjh7-p2fx-99vx
5+
url: https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx
6+
title: Rack has an Unbounded-Parameter DoS in Rack::QueryParser
7+
date: 2025-05-08
8+
description: |
9+
## Summary
10+
11+
`Rack::QueryParser` parses query strings and
12+
`application/x-www-form-urlencoded` bodies into Ruby data structures
13+
without imposing any limit on the number of parameters, allowing
14+
attackers to send requests with extremely large numbers of parameters.
15+
16+
## Details
17+
18+
The vulnerability arises because `Rack::QueryParser` iterates over
19+
each `&`-separated key-value pair and adds it to a Hash without
20+
enforcing an upper bound on the total number of parameters. This
21+
allows an attacker to send a single request containing hundreds of
22+
thousands (or more) of parameters, which consumes excessive memory
23+
and CPU during parsing.
24+
25+
## Impact
26+
27+
An attacker can trigger denial of service by sending specifically
28+
crafted HTTP requests, which can cause memory exhaustion or pin CPU
29+
resources, stalling or crashing the Rack server. This results in
30+
full service disruption until the affected worker is restarted.
31+
32+
## Mitigation
33+
34+
- Update to a version of Rack that limits the number of parameters parsed, or
35+
- Use middleware to enforce a maximum query string size or parameter count, or
36+
- Employ a reverse proxy (such as Nginx) to limit request sizes and
37+
reject oversized query strings or bodies.
38+
39+
Limiting request body sizes and query string lengths at the web
40+
server or CDN level is an effective mitigation.
41+
cvss_v3: 7.5
42+
patched_versions:
43+
- "~> 2.2.14"
44+
- "~> 3.0.16"
45+
- ">= 3.1.14"
46+
related:
47+
url:
48+
- https://nvd.nist.gov/vuln/detail/CVE-2025-46727
49+
- https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx
50+
- https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712
51+
- https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3
52+
- https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74
53+
- https://github.com/advisories/GHSA-gjh7-p2fx-99vx

0 commit comments

Comments
 (0)