CVE-2015-3225

Name	CVE-2015-3225
Description	lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-254-1, DSA-3322-1
Debian Bugs	789311

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-rack (PTS)	buster	2.0.6-3	fixed
	buster (security)	2.0.6-3+deb10u3	fixed
	bullseye	2.1.4-3	fixed
	bookworm, sid	2.2.6.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
librack-ruby	source	squeeze	1.1.0-4+squeeze3	DLA-254-1
librack-ruby	source	(unstable)	(unfixed)
ruby-rack	source	wheezy	1.4.1-2.1+deb7u1	DSA-3322-1
ruby-rack	source	jessie	1.5.2-3+deb8u1	DSA-3322-1
ruby-rack	source	(unstable)	1.5.2-4		789311
ruby-rack1.4	source	(unstable)	(unfixed)

http://seclists.org/oss-sec/2015/q2/729 has patches for 1.5 and 1.6