PT-2013-2198 · Rack+1 · Rack+1
Publicado
2013-02-08
·
Atualizado
2026-03-13
·
CVE-2013-0263
CVSS v2.0
5.1
Média
| Vetor | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Rack versions 1.1.x before 1.1.6
Rack versions 1.2.x before 1.2.8
Rack versions 1.3.x before 1.3.10
Rack versions 1.4.x before 1.4.5
Rack versions 1.5.x before 1.5.2
Description
The issue allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time. This is related to the Rack::Session::Cookie component.
Recommendations
For Rack version 1.1.x, update to version 1.1.6 or later.
For Rack version 1.2.x, update to version 1.2.8 or later.
For Rack version 1.3.x, update to version 1.3.10 or later.
For Rack version 1.4.x, update to version 1.4.5 or later.
For Rack version 1.5.x, update to version 1.5.2 or later.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Rack
Suse