CVE-2018-16470 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2018-16470 Interim 1 54 2023-06-23T00:13:33Z current 2021-05-30T14:16:32Z 2023-06-23T00:13:33Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2018-16470 There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2019-February/005090.html E-Mail link for SUSE-SU-2019:0272-1 https://lists.opensuse.org/opensuse-security-announce/2019-02/msg00026.html E-Mail link for openSUSE-SU-2019:0185-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.0 SUSE Enterprise Storage 4 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Lifecycle Management Server 1.3 SUSE Linux Enterprise High Availability Extension 15 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Server Business Critical Linux 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Manager Proxy 4.0 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Manager Retail Branch Server 4.0 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Manager Server 4.0 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE OpenStack Cloud 6-LTSS SUSE OpenStack Cloud 7 SUSE OpenStack Cloud Crowbar 8 openSUSE Leap 15.0 openSUSE Tumbleweed rmt-server rmt-server-1.1.1-3.13.1 rmt-server-1.1.1-lp150.2.12.1 rmt-server-1.2.2-1.15 rmt-server-2.5.4-1.39 rmt-server-2.6.13-1.1 rmt-server-2.6.8-1.2 rmt-server-2.7.1-150400.1.7 rmt-server-config rmt-server-config-2.5.4-1.39 rmt-server-config-2.6.13-1.1 rmt-server-config-2.6.8-1.2 rmt-server-config-2.7.1-150400.1.7 rmt-server-pubcloud rmt-server-pubcloud-1.1.1-lp150.2.12.1 rmt-server-pubcloud-1.2.2-1.15 rmt-server-pubcloud-2.5.4-1.39 rmt-server-pubcloud-2.6.13-1.1 rmt-server-pubcloud-2.6.8-1.2 rmt-server-pubcloud-2.7.1-150400.1.7 rmt-server-pubcloud-2.9-150500.1.4 ruby2.1-rubygem-rack ruby2.5-rubygem-rack rubygem-rack rmt-server-pubcloud-1.2.2-1.15 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP1 rmt-server-pubcloud-2.5.4-1.39 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP2 rmt-server-pubcloud-2.6.8-1.2 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP3 rmt-server-pubcloud-2.7.1-150400.1.7 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4 rmt-server-pubcloud-2.9-150500.1.4 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5 rmt-server-1.1.1-3.13.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 rmt-server-1.2.2-1.15 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 rmt-server-2.5.4-1.39 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 rmt-server-config-2.5.4-1.39 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 rmt-server-2.6.8-1.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 rmt-server-config-2.6.8-1.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 rmt-server-2.7.1-150400.1.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 rmt-server-config-2.7.1-150400.1.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 rmt-server-1.1.1-lp150.2.12.1 as a component of openSUSE Leap 15.0 rmt-server-pubcloud-1.1.1-lp150.2.12.1 as a component of openSUSE Leap 15.0 rmt-server-2.6.13-1.1 as a component of openSUSE Tumbleweed rmt-server-config-2.6.13-1.1 as a component of openSUSE Tumbleweed rmt-server-pubcloud-2.6.13-1.1 as a component of openSUSE Tumbleweed rmt-server as a component of SUSE CaaS Platform 4.0 rmt-server-config as a component of SUSE CaaS Platform 4.0 ruby2.1-rubygem-rack as a component of SUSE Enterprise Storage 4 rubygem-rack as a component of SUSE Enterprise Storage 4 rmt-server as a component of SUSE Enterprise Storage 6 rubygem-rack as a component of SUSE Lifecycle Management Server 1.3 ruby2.5-rubygem-rack as a component of SUSE Linux Enterprise High Availability Extension 15 rubygem-rack as a component of SUSE Linux Enterprise High Availability Extension 15 rmt-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS rmt-server-config as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS rmt-server-pubcloud as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP1 rmt-server as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP1 rmt-server as a component of SUSE Linux Enterprise Server 15 SP1-LTSS rmt-server-config as a component of SUSE Linux Enterprise Server 15 SP1-LTSS rmt-server as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP1 rmt-server as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 rmt-server-config as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 rmt-server as a component of SUSE Manager Proxy 4.0 rmt-server as a component of SUSE Manager Retail Branch Server 4.0 rmt-server as a component of SUSE Manager Server 4.0 ruby2.1-rubygem-rack as a component of SUSE OpenStack Cloud 6-LTSS rubygem-rack as a component of SUSE OpenStack Cloud 6-LTSS ruby2.1-rubygem-rack as a component of SUSE OpenStack Cloud 7 rubygem-rack as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-rack as a component of SUSE OpenStack Cloud Crowbar 8 rubygem-rack as a component of SUSE OpenStack Cloud Crowbar 8 There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size. CVE-2018-16470 SUSE Linux Enterprise Module for Public Cloud 15 SP1:rmt-server-pubcloud-1.2.2-1.15 SUSE Linux Enterprise Module for Public Cloud 15 SP2:rmt-server-pubcloud-2.5.4-1.39 SUSE Linux Enterprise Module for Public Cloud 15 SP3:rmt-server-pubcloud-2.6.8-1.2 SUSE Linux Enterprise Module for Public Cloud 15 SP4:rmt-server-pubcloud-2.7.1-150400.1.7 SUSE Linux Enterprise Module for Public Cloud 15 SP5:rmt-server-pubcloud-2.9-150500.1.4 SUSE Linux Enterprise Module for Server Applications 15:rmt-server-1.1.1-3.13.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:rmt-server-1.2.2-1.15 SUSE Linux Enterprise Module for Server Applications 15 SP2:rmt-server-2.5.4-1.39 SUSE Linux Enterprise Module for Server Applications 15 SP2:rmt-server-config-2.5.4-1.39 SUSE Linux Enterprise Module for Server Applications 15 SP3:rmt-server-2.6.8-1.2 SUSE Linux Enterprise Module for Server Applications 15 SP3:rmt-server-config-2.6.8-1.2 SUSE Linux Enterprise Module for Server Applications 15 SP4:rmt-server-2.7.1-150400.1.7 SUSE Linux Enterprise Module for Server Applications 15 SP4:rmt-server-config-2.7.1-150400.1.7 openSUSE Leap 15.0:rmt-server-1.1.1-lp150.2.12.1 openSUSE Leap 15.0:rmt-server-pubcloud-1.1.1-lp150.2.12.1 openSUSE Tumbleweed:rmt-server-2.6.13-1.1 openSUSE Tumbleweed:rmt-server-config-2.6.13-1.1 openSUSE Tumbleweed:rmt-server-pubcloud-2.6.13-1.1 SUSE CaaS Platform 4.0:rmt-server SUSE CaaS Platform 4.0:rmt-server-config SUSE Enterprise Storage 4:ruby2.1-rubygem-rack SUSE Enterprise Storage 4:rubygem-rack SUSE Enterprise Storage 6:rmt-server SUSE Lifecycle Management Server 1.3:rubygem-rack SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-rack SUSE Linux Enterprise High Availability Extension 15:rubygem-rack SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:rmt-server SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:rmt-server-config SUSE Linux Enterprise Module for Public Cloud 15 SP1:rmt-server SUSE Linux Enterprise Module for Public Cloud 15 SP1:rmt-server-pubcloud SUSE Linux Enterprise Server 15 SP1-LTSS:rmt-server SUSE Linux Enterprise Server 15 SP1-LTSS:rmt-server-config SUSE Linux Enterprise Server Business Critical Linux 15 SP1:rmt-server SUSE Linux Enterprise Server for SAP Applications 15 SP1:rmt-server SUSE Linux Enterprise Server for SAP Applications 15 SP1:rmt-server-config SUSE Manager Proxy 4.0:rmt-server SUSE Manager Retail Branch Server 4.0:rmt-server SUSE Manager Server 4.0:rmt-server SUSE OpenStack Cloud 6-LTSS:ruby2.1-rubygem-rack SUSE OpenStack Cloud 6-LTSS:rubygem-rack SUSE OpenStack Cloud 7:ruby2.1-rubygem-rack SUSE OpenStack Cloud 7:rubygem-rack SUSE OpenStack Cloud Crowbar 8:ruby2.1-rubygem-rack SUSE OpenStack Cloud Crowbar 8:rubygem-rack moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L