Read the docs
TI-2022-12397 Aliases CVE-2022-30123GHSA-wq4h-7r42-5hrr

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which…

Priority MEDIUM 47CWE-150Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

Why it matters now

EPSS 0.01955 80th percentileScored 2026-11-07
Fix Partial rack (RubyGems): 2.0.9.1, 2.1.4.1, 2.2.3.1Red Hat: 3 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/rack/rack2.0.9.1, 2.1.4.1, 2.2.3.1—No fix listedCNA
—rack (RubyGems)before 2.0.9.12.0.9.1Patch availableGHSA-wq4h-7r42-5hrr
—rack (RubyGems)2.1 to before 2.1.4.12.1.4.1Patch availableGHSA-wq4h-7r42-5hrr
—rack (RubyGems)2.2 to before 2.2.3.12.2.3.1Patch availableGHSA-wq4h-7r42-5hrr
  • https://github.com/rack/rack Vendor— Affected 2.0.9.1, 2.1.4.1, 2.2.3.1 Fixed in — No fix listed CNA
  • rack (RubyGems) Vendor— Affected before 2.0.9.1 Fixed in 2.0.9.1 Patch available GHSA-wq4h-7r42-5hrr
  • rack (RubyGems) Vendor— Affected 2.1 to before 2.1.4.1 Fixed in 2.1.4.1 Patch available GHSA-wq4h-7r42-5hrr
  • rack (RubyGems) Vendor— Affected 2.2 to before 2.2.3.1 Fixed in 2.2.3.1 Patch available GHSA-wq4h-7r42-5hrr

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:*before 2.0.9.1; 2.1.0 to before 2.1.4.1; 2.2.0 to before 2.2.3.1VulnerableRack Project
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:* Versions before 2.0.9.1; 2.1.0 to before 2.1.4.1; 2.2.0 to before 2.2.3.1 Vulnerable ·Rack Project
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-wq4h-7r42-5hrr rack (RubyGems) Fixed in 2.0.9.1 Advisory →
  • Fix · GHSA-wq4h-7r42-5hrr rack (RubyGems) Fixed in 2.1.4.1 Advisory →
  • Fix · GHSA-wq4h-7r42-5hrr rack (RubyGems) Fixed in 2.2.3.1 Advisory →

Red Hat 3 advisories

  • RHSA-2023:1486 Released 2023-03-28 · Red Hat rating Important
    Red Hat Gluster Storage web-admin-build security update
    • Red Hat Gluster 3.5 Web Administration on RHEL-7 grafana-5.2.4-6.el7rhgs, rubygem-puma-4.3.12-1.el7rhgs, rubygem-puma-doc-4.3.12-1.el7rhgs +4
  • RHSA-2023:0632 Released 2023-02-15 · Red Hat rating Moderate
    Red Hat OpenShift (Logging Subsystem) security update
    • RHOL 5.4 for RHEL 8 openshift-logging/fluentd-rhel8, openshift-logging/lokistack-gateway-rhel8
  • RHSA-2022:7343 Released 2022-11-02 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux Server High Availability (v. 7) pcs-0.9.169-3.el7_9.3, pcs-snmp-0.9.169-3.el7_9.3
    • Red Hat Enterprise Linux Server Resilient Storage (v. 7) pcs-0.9.169-3.el7_9.3, pcs-snmp-0.9.169-3.el7_9.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    https://github.com/rack/rack — GLSA-202310-18

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2022-12396 Uncontrolled resource consumption in https://github.com/rack/rackPriority MEDIUM 43
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens) Operational ToolsAffectedNo fix planned: Will not fix
RHOL 5.4 for RHEL 8Fixed RHSA-2023:0632
Red Hat Enterprise Linux Server High Availability (v. 7)Fixed RHSA-2022:7343
Red Hat Enterprise Linux Server Resilient Storage (v. 7)Fixed RHSA-2022:7343
Red Hat Gluster 3.5 Web Administration on RHEL-7Fixed RHSA-2023:1486
Not affected: 3 products
  • RHOL 5.4 for RHEL 8
  • Red Hat Gluster 3.5 Web Administration on RHEL-7
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30123
  2. 2026-10-03 Alias added: GHSA-wq4h-7r42-5hrr

References

Advisory 4

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences