lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

A flaw was found in a way Rack processed parameters of incoming requests. An attacker could use this flaw to send a crafted request that would cause an application using Rack to crash. (CVE-2015-3225)

The pcs package has been upgraded to upstream version 0.9.143, which provides a number of bug fixes and enhancements over the previous version.

  - The pcs resource move and pcs resource ban commands now     display a warning message to clarify the commands'     behavior

  - New command to move a Pacemaker resource to its     preferred node

This update also fixes the following bugs :

  - Before this update, a bug caused location, ordering, and     colocation constraints related to a resource group to be     removed when removing any resource from that group. This     bug has been fixed, and the constraints are now     preserved until the group has no resources left, and is     removed.

  - Previously, when a user disabled a resource clone or     multi-state resource, and then later enabled a primitive     resource within it, the clone or multi-state resource     remained disabled. With this update, enabling a resource     within a disabled clone or multi-state resource enables     it.

  - When the web UI displayed a list of resource attributes,     a bug caused the list to be truncated at the first '='     character. This update fixes the bug and now the web UI     displays lists of resource attributes correctly.

  - The documentation for the 'pcs stonith confirm' command     was not clear. This could lead to incorrect usage of the     command, which could in turn cause data corruption. With     this update, the documentation has been improved and the     'pcs stonith confirm' command is now more clearly     explained.

  - Previously, if there were any unauthenticated nodes,     creating a new cluster, adding a node to an existing     cluster, or adding a cluster to the web UI failed with     the message 'Node is not authenticated'. With this     update, when the web UI detects a problem with     authentication, the web UI displays a dialog to     authenticate nodes as necessary.

  - Previously, the web UI displayed only primitive     resources. Thus there was no way to set attributes,     constraints and other properties separately for a parent     resource and a child resource. This has now been fixed,     and resources are displayed in a tree structure, meaning     all resource elements can be viewed and edited     independently.

In addition, this update adds the following enhancements :

  - A dashboard has been added which shows the status of     clusters in the web UI. Previously, it was not possible     to view all important information about clusters in one     place. Now, a dashboard showing the status of clusters     has been added to the main page of the web UI.

  - With this update, the pcsd daemon automatically     synchronizes pcsd configuration across a cluster. This     enables the web UI to be run from any node, allowing     management even if any particular node is down.

  - The web UI can now be used to set permissions for users     and groups on a cluster. This allows users and groups to     have their access restricted to certain operations on     certain clusters.

An updated pcs package that fixes one security issue, several bugs, and add various enhancements is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The pcs package provides a configuration tool for Corosync and Pacemaker. It permits users to easily view, modify and create Pacemaker based clusters. The pcs package includes Rack, which provides a minimal interface between webservers that support Ruby and Ruby frameworks.

A flaw was found in a way Rack processed parameters of incoming requests. An attacker could use this flaw to send a crafted request that would cause an application using Rack to crash. (CVE-2015-3225)

Red Hat would like to thank Ruby upstream developers for reporting this. Upstream acknowledges Tomek Rabczak from the NCC Group as the original reporter.

The pcs package has been upgraded to upstream version 0.9.143, which provides a number of bug fixes and enhancements over the previous version. (BZ#1198265)

The following enhancements are described in more detail in the Red Hat Enterprise Linux 7.2 Release Notes, linked to from the References section :

* The pcs resource move and pcs resource ban commands now display a warning message to clarify the commands' behavior (BZ#1201452)

* New command to move a Pacemaker resource to its preferred node (BZ#1122818)

This update also fixes the following bugs :

* Before this update, a bug caused location, ordering, and colocation constraints related to a resource group to be removed when removing any resource from that group. This bug has been fixed, and the constraints are now preserved until the group has no resources left, and is removed. (BZ#1158537)

* Previously, when a user disabled a resource clone or multi-state resource, and then later enabled a primitive resource within it, the clone or multi-state resource remained disabled. With this update, enabling a resource within a disabled clone or multi-state resource enables it. (BZ#1218979)

* When the web UI displayed a list of resource attributes, a bug caused the list to be truncated at the first '=' character. This update fixes the bug and now the web UI displays lists of resource attributes correctly. (BZ#1243579)

* The documentation for the 'pcs stonith confirm' command was not clear. This could lead to incorrect usage of the command, which could in turn cause data corruption. With this update, the documentation has been improved and the 'pcs stonith confirm' command is now more clearly explained. (BZ#1245264)

* Previously, if there were any unauthenticated nodes, creating a new cluster, adding a node to an existing cluster, or adding a cluster to the web UI failed with the message 'Node is not authenticated'. With this update, when the web UI detects a problem with authentication, the web UI displays a dialog to authenticate nodes as necessary.
(BZ#1158569)

* Previously, the web UI displayed only primitive resources. Thus there was no way to set attributes, constraints and other properties separately for a parent resource and a child resource. This has now been fixed, and resources are displayed in a tree structure, meaning all resource elements can be viewed and edited independently.
(BZ#1189857)

In addition, this update adds the following enhancements :

* A dashboard has been added which shows the status of clusters in the web UI. Previously, it was not possible to view all important information about clusters in one place. Now, a dashboard showing the status of clusters has been added to the main page of the web UI.
(BZ#1158566)

* With this update, the pcsd daemon automatically synchronizes pcsd configuration across a cluster. This enables the web UI to be run from any node, allowing management even if any particular node is down.
(BZ#1158577)

* The web UI can now be used to set permissions for users and groups on a cluster. This allows users and groups to have their access restricted to certain operations on certain clusters. (BZ#1158571)

All pcs users are advised to upgrade to this updated package, which corrects these issues and add these enhancements.

Fix for CVE-2015-3225: Potential Denial of Service Vulnerability in Rack - Related rhbz#CVE-2015-3225 New rubygem-rack-1.6.1-1.fc22

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2015-3225: Potential Denial of Service Vulnerability in Rack

  - Related rhbz#CVE-2015-3225

New rubygem-rack-1.6.1-1.fc22

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tomek Rabczak from the NCC Group discovered a flaw in the normalize_params() method in Rack, a modular Ruby webserver interface.
A remote attacker can use this flaw via specially crafted requests to cause a `SystemStackError` and potentially cause a denial of service condition for the service.

rubygem-rack-1_4 was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-3225: Potential Denial of Service Vulnerability     in Rack (bsc#934797).

rubygem-rack-1_3 was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-3225: Potential Denial of Service Vulnerability     in Rack (bsc#934797).

rubygem-rack was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-3225: Potential Denial of Service Vulnerability     in Rack (bsc#934797).

There is a potential denial of service vulnerability in Rack, a modular Ruby webserver interface.

Carefully crafted requests can cause a `SystemStackError` and cause a denial of service attack by exploiting the lack of a sensible depth check when doing parameter normalization.

We recommend that you update your librack-ruby packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ruby on Rails blog :

Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.

ID	Name	Product	Family	Severity
87569	Scientific Linux Security Update : pcs on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	medium
87148	CentOS 7 : pcs (CESA-2015:2290)	Nessus	CentOS Local Security Checks	medium
86980	RHEL 7 : pcs (RHSA-2015:2290)	Nessus	Red Hat Local Security Checks	medium
85665	Fedora 21 : rubygem-rack-1.5.2-5.fc21 (2015-12979)	Nessus	Fedora Local Security Checks	medium
85550	Fedora 22 : rubygem-rack-1.6.1-2.fc22 (2015-12978)	Nessus	Fedora Local Security Checks	medium
85161	Debian DSA-3322-1 : ruby-rack - security update	Nessus	Debian Local Security Checks	medium
84869	openSUSE Security Update : rubygem-rack-1_4 (openSUSE-2015-500)	Nessus	SuSE Local Security Checks	medium
84868	openSUSE Security Update : rubygem-rack-1_3 (openSUSE-2015-499)	Nessus	SuSE Local Security Checks	medium
84867	openSUSE Security Update : rubygem-rack (openSUSE-2015-498)	Nessus	SuSE Local Security Checks	medium
84408	Debian DLA-254-1 : librack-ruby security update	Nessus	Debian Local Security Checks	medium
84255	FreeBSD : rubygem-rails -- multiple vulnerabilities (eb8a8978-8dd5-49ce-87f4-49667b2166dd)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3225

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium