REDHAT-BUG-2454486: High severity Rack Rack::Static vulnerability
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.23 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.6
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2454486?
The severity of REDHAT-BUG-2454486 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2454486?
To fix REDHAT-BUG-2454486, update Rack to versions 2.2.23, 3.1.21, or 3.2.6 or later.
What is the impact of REDHAT-BUG-2454486?
The impact of REDHAT-BUG-2454486 is that it may allow unauthorized access to static files due to inadequate request handling.
Which versions of Rack are affected by REDHAT-BUG-2454486?
Rack versions prior to 2.2.23, 3.1.21, and 3.2.6 are affected by REDHAT-BUG-2454486.
What component of Rack is involved in REDHAT-BUG-2454486?
The component involved in REDHAT-BUG-2454486 is Rack::Static, which handles static file requests.