Описание
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted input can cause If-Match and If-None-Match header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the ETag header value. Any applications that use the etag method when generating a response are impacted. Version 4.2.0 fixes the issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 4.2.1-1 |
| esm-apps-legacy/xenial | released | 1.4.7-3ubuntu0.1~esm3 |
| esm-apps/bionic | released | 1.4.8-1ubuntu0.1~esm3 |
| esm-apps/focal | released | 2.0.8.1-1ubuntu0.1~esm3 |
| esm-apps/jammy | released | 2.0.8.1-2+deb11u1ubuntu0.1~esm1 |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| jammy | needed | |
| noble | not-affected | see note |
| plucky | not-affected | see note |
| questing | not-affected | see note |
Показывать по
EPSS
7.5 High
CVSS3
Связанные уязвимости
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
Sinatra is a domain-specific language for creating web applications in ...
Sinatra is vulnerable to ReDoS through ETag header value generation
Уязвимость парсера фреймворка разработки веб-приложений на Ruby Sinatra, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3