Vulnerability Name:

CVE-2018-16470 (CCN-152635)

Assigned:2018-11-05
Published:2018-11-05
Updated:2019-10-09
Summary:There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-400
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2018-16470

Source: REDHAT
Type: UNKNOWN
RHSA-2019:3172

Source: XF
Type: UNKNOWN
rack-cve201816470-dos(152635)

Source: MISC
Type: Mailing List, Patch, Third Party Advisory
https://groups.google.com/forum/#!msg/rubyonrails-security/U_x-YkfuVTg/xhvYAmp6AAAJ

Source: CCN
Type: Rack Web site
Rack: a Ruby Webserver Interface

Source: CCN
Type: oss-sec Mailing List, Mon, 5 Nov 2018 12:07:39 -0800
[CVE-2018-16470] Possible DoS vulnerability in Rack

Vulnerable Configuration:Configuration 1:
  • cpe:/a:rack_project:rack:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:rack_project:rack:2.0.5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201816470
    V
    		CVE-2018-16470
    2022-09-02
    oval:org.opensuse.security:def:620
    P
    		Security update for booth (Important)
    2022-08-01
    oval:org.opensuse.security:def:3458
    P
    		cpp48-4.8.5-31.20.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3520
    P
    		gvim-7.4.326-17.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95088
    P
    		rmt-server-pubcloud-2.7.1-150400.1.7 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95150
    P
    		rmt-server-2.7.1-150400.1.7 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:1067
    P
    		Security update for jasper (Moderate)
    2022-04-29
    oval:org.opensuse.security:def:1654
    P
    		Security update for 389-ds (Important)
    2022-04-04
    oval:org.opensuse.security:def:950
    P
    		Security update for jasper (Moderate)
    2022-02-24
    oval:org.opensuse.security:def:94241
    P
    		 (Important)
    2022-01-25
    oval:org.opensuse.security:def:113338
    P
    		rmt-server-2.6.13-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106745
    P
    		Security update for poppler (Important)
    2021-12-01
    oval:org.opensuse.security:def:51701
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-11-23
    oval:org.opensuse.security:def:64592
    P
    		Security update for krb5 (Moderate)
    2021-10-18
    oval:org.opensuse.security:def:94187
    P
    		 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:97034
    P
    		rmt-server-1.2.2-1.15 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:63234
    P
    		rmt-server-1.2.2-1.15 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:90069
    P
    		rmt-server-1.2.2-1.15 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:2145
    P
    		rmt-server-1.2.2-1.15 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:71266
    P
    		libjasper4-2.0.14-3.3.2 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:103724
    P
    		rmt-server-1.2.2-1.15 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:71379
    P
    		python3-pip-10.0.1-1.9 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:71329
    P
    		libvmtools-devel-10.3.10-1.10 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:66910
    P
    		Security update for jetty-minimal (Moderate)
    2021-08-25
    oval:org.opensuse.security:def:48172
    P
    		libpng12-0-1.2.50-19.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48049
    P
    		jakarta-taglibs-standard-1.1.1-255.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48141
    P
    		libldap-2_4-2-2.4.41-18.63.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47472
    P
    		policycoreutils-2.5-9.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48289
    P
    		python-urllib3-1.22-3.17.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47486
    P
    		python3-3.4.6-24.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47471
    P
    		pigz-2.3-5.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47607
    P
    		fetchmail-6.3.26-12.3 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47589
    P
    		cyrus-sasl-2.1.26-8.7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47800
    P
    		libupsclient1-2.7.1-1.30 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47603
    P
    		emacs-24.3-25.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47588
    P
    		cvs-1.12.12-182.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47932
    P
    		yast2-users-3.2.17-1.5 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47724
    P
    		libjasper1-1.900.14-195.8.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48024
    P
    		gnome-shell-3.20.4-77.23.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:64742
    P
    		Security update for cpio (Important)
    2021-08-16
    oval:org.opensuse.security:def:47917
    P
    		wget-1.14-21.7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:2281
    P
    		rmt-server-2.6.8-1.2 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:2042
    P
    		rmt-server-pubcloud-2.6.8-1.2 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63370
    P
    		rmt-server-2.6.8-1.2 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63131
    P
    		rmt-server-pubcloud-2.6.8-1.2 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:101396
    P
    		rmt-server-2.6.8-1.2 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:100900
    P
    		libcaca-devel-0.99.beta19.git20171003-9.28 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100954
    P
    		libpcre2-16-0-10.31-1.14 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:70266
    P
    		Security update for nodejs8 (Important)
    2021-08-05
    oval:org.opensuse.security:def:68026
    P
    		Security update for the Linux Kernel (Live Patch 18 for SLE 15 SP1) (Important)
    2021-07-27
    oval:org.opensuse.security:def:51616
    P
    		Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP3) (Important)
    2021-07-21
    oval:org.opensuse.security:def:66856
    P
    		Security update for clamav-database (Important)
    2021-07-12
    oval:org.opensuse.security:def:4137
    P
    		Security update for gupnp (Important)
    2021-06-24
    oval:org.opensuse.security:def:1470
    P
    		Security update for libjpeg-turbo (Moderate)
    2021-06-11
    oval:org.opensuse.security:def:1589
    P
    		Security update for the Linux Kernel (Important)
    2021-06-09
    oval:org.opensuse.security:def:4133
    P
    		Security update for libopenmpt (Moderate)
    2021-06-09
    oval:org.opensuse.security:def:48816
    P
    		rhythmbox-3.4-6.14 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48386
    P
    		coolkey-1.1.0-147.67 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48470
    P
    		libXp6-1.0.2-3.57 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48532
    P
    		libpango-1_0-0-1.40.1-9.5 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:66818
    P
    		Security update for libX11 (Important)
    2021-06-08
    oval:org.opensuse.security:def:48503
    P
    		libicu-doc-52.1-7.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48597
    P
    		perl-LWP-Protocol-https-6.04-5.4 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48587
    P
    		p7zip-9.20.1-6.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48628
    P
    		sudo-1.8.10p3-6.16 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48649
    P
    		xdg-utils-20140630-5.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48699
    P
    		libxerces-c-3_1-3.1.1-1.6 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48714
    P
    		cyrus-sasl-digestmd5-32bit-2.1.26-7.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48745
    P
    		libsilc-1_1-2-1.1.10-24.128 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:67989
    P
    		Security update for the Linux Kernel (Live Patch 17 for SLE 15 SP1) (Important)
    2021-05-25
    oval:org.opensuse.security:def:4123
    P
    		Security update for openexr (Important)
    2021-05-04
    oval:org.opensuse.security:def:66764
    P
    		Security update for openexr (Important)
    2021-05-04
    oval:org.opensuse.security:def:70212
    P
    		Security update for sca-patterns-sle11 (Important)
    2021-05-04
    oval:org.opensuse.security:def:64679
    P
    		Security update for permissions (Important)
    2021-05-04
    oval:org.opensuse.security:def:1461
    P
    		Security update for python-Pygments (Important)
    2021-05-04
    oval:org.opensuse.security:def:51882
    P
    		Security update for cups (Important)
    2021-04-30
    oval:org.opensuse.security:def:64655
    P
    		Security update for python-cryptography (Important)
    2021-02-25
    oval:org.opensuse.security:def:68089
    P
    		Security update for the Linux Kernel (Live Patch 12 for SLE 15 SP1) (Important)
    2021-02-10
    oval:org.opensuse.security:def:4130
    P
    		Security update for gdk-pixbuf (Moderate)
    2021-01-21
    oval:org.opensuse.security:def:73601
    P
    		Security update for openldap2 (Moderate)
    2021-01-14
    oval:org.opensuse.security:def:4100
    P
    		nut-cgi-2.7.4-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107566
    P
    		rmt-server-pubcloud-2.5.4-1.39 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:71442
    P
    		autoyast2-4.2.37-1.6 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3916
    P
    		guile-devel-2.0.9-9.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3908
    P
    		gnome-shell-devel-3.20.4-77.23.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3928
    P
    		lib3ds-1-3-1.3.0-25.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63110
    P
    		rmt-server-pubcloud-1.2.2-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107620
    P
    		rmt-server-2.5.4-1.39 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:3968
    P
    		libcroco-0.6.11-12.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63299
    P
    		rmt-server-2.5.4-1.39 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:103679
    P
    		rmt-server-pubcloud-1.2.2-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:51081
    P
    		Security update for gdm (Important)
    2020-12-03
    oval:org.opensuse.security:def:3999
    P
    		libjpeg8-devel-8.1.2-31.14.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63119
    P
    		rmt-server-pubcloud-2.5.4-1.39 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2021
    P
    		rmt-server-pubcloud-1.2.2-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:117124
    P
    		rmt-server-pubcloud-2.5.4-1.39 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4011
    P
    		libmusicbrainz-devel-2.1.5-27.79 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2210
    P
    		rmt-server-2.5.4-1.39 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4027
    P
    		libpcap-devel-1.8.1-10.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2030
    P
    		rmt-server-pubcloud-2.5.4-1.39 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4083
    P
    		libxslt-devel-1.1.28-17.6.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:117178
    P
    		rmt-server-2.5.4-1.39 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:90024
    P
    		rmt-server-pubcloud-1.2.2-1.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4775
    P
    		Security update for libvirt (Important)
    2020-12-02
    oval:org.opensuse.security:def:4796
    P
    		Security update for rmt-server (Moderate)
    2020-12-02
    oval:org.opensuse.security:def:50448
    P
    		Security update for postgresql10 (Important)
    2020-12-01
    oval:org.opensuse.security:def:50425
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50041
    P
    		vsftpd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50095
    P
    		rmt-server on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50581
    P
    		Security update for wicked (Important)
    2020-12-01
    oval:org.opensuse.security:def:51773
    P
    		Security update for cloud-init (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49848
    P
    		nasm on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73429
    P
    		libjbig2-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50814
    P
    		Security update for glibc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:51807
    P
    		Security update for go1.11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49902
    P
    		rmt-server-pubcloud on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:70107
    P
    		libopus-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:53158
    P
    		Security update for salt (Critical)
    2020-12-01
    oval:org.opensuse.security:def:50977
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:53227
    P
    		Security update for rmt-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73547
    P
    		rmt-server-pubcloud on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49857
    P
    		perl-Mail-SpamAssassin-Plugin-iXhash2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73483
    P
    		apache-pdfbox on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49911
    P
    		rmt-server-pubcloud on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:70161
    P
    		cvs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:51245
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:67926
    P
    		libpango-1_0-0-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:51515
    P
    		Security update for go1.15 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49976
    P
    		salt-api on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50030
    P
    		rmt-server on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50426
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:com.ubuntu.xenial:def:2018164700000000
    V
    		CVE-2018-16470 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-11-13
    oval:com.ubuntu.bionic:def:201816470000
    V
    		CVE-2018-16470 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-11-13
    oval:com.ubuntu.disco:def:2018164700000000
    V
    		CVE-2018-16470 on Ubuntu 19.04 (disco) - medium.
    2018-11-13
    oval:com.ubuntu.cosmic:def:201816470000
    V
    		CVE-2018-16470 on Ubuntu 18.10 (cosmic) - medium.
    2018-11-13
    oval:com.ubuntu.cosmic:def:2018164700000000
    V
    		CVE-2018-16470 on Ubuntu 18.10 (cosmic) - medium.
    2018-11-13
    oval:com.ubuntu.trusty:def:201816470000
    V
    		CVE-2018-16470 on Ubuntu 14.04 LTS (trusty) - medium.
    2018-11-13
    oval:com.ubuntu.bionic:def:2018164700000000
    V
    		CVE-2018-16470 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-11-13
    oval:com.ubuntu.xenial:def:201816470000
    V
    		CVE-2018-16470 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-11-13
    BACK
    rack_project rack 2.0.4
    rack_project rack 2.0.5