CVE-2025-61771 (High) detected in rack-3.1.16.gem
还没有人认领这个 Issue。
评估
调研方向
从 /Gemfile.lock 和缓存于 /vendor/cache/rack-3.1.16.gem 的依赖项开始，然后检查 advisory 及其中列出的已修复 Rack 版本。将依赖项更新到受支持的已修复版本，并按需刷新 lockfile 或缓存；当项目不再引用 rack-3.1.16.gem，且使用 3.1.17、3.2.2 或 2.2.19 时，即表示完成。
由索引模型根据 Issue 内容生成。
描述
CVE-2025-61771 - High Severity Vulnerability
Vulnerable Library - rack-3.1.16.gem
Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.
Library home page: https://rubygems.org/gems/rack-3.1.16.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /vendor/cache/rack-3.1.16.gem
Dependency Hierarchy:
- manageiq-style-1.3.3.gem (Root Library)
- rubocop-rails-2.32.0.gem
- ❌ rack-3.1.16.gem (Vulnerable Library)
- rubocop-rails-2.32.0.gem
Found in base branch: master
Vulnerability Details
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser"stores non-file form fields (parts without a"filename") entirely in memory as Ruby "String"objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. All Rack applications processing multipart form submissions are affected. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a reasonable size cap for non-file fields (e.g., 2 MiB). Workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., Nginx"client_max_body_size`) and validating and rejecting unusually large form fields at the application level.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-10-07
URL: CVE-2025-61771
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-w9pc-fmgc-vxvw
Release Date: 2025-10-07
Fix Resolution: rack - 3.2.2,rack - 2.2.19,rack - 3.1.17,https://github.com/rack/rack.git - v2.2.19,https://github.com/rack/rack.git - v3.2.2,https://github.com/rack/rack.git - v3.1.17
Step up your Open Source Security Game with Mend here
- 主要语言
- Ruby
- 星标
- 30
- 派生
- 27
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ManageIQ/linux_admin 的其他 Issue
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 68/100
ManageIQ/linux_admin#291 ·
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 75/100
ManageIQ/linux_admin#290 ·
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 72/100
ManageIQ/linux_admin#289 ·
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 68/100
ManageIQ/linux_admin#288 ·
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 76/100
ManageIQ/linux_admin#286 ·
查看 ManageIQ/linux_admin 的全部 Issue
相似的 Issue
-
Unconfirmed users who reset their password are stuck on sign in with no way to send confirmation未关闭
难度 2/5 1-3 小时 新手友好度 79/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
L: github:actions L: javascript
难度 2/5 1-3 小时 新手友好度 75/100
dependabot/dependabot-core#16615 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 61/100
hitobito/hitobito_pfadi_de#164 ·
维护者通常 5 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 7 天内回复