PT-2014-4770 · Ruby+1 · Rack-Ssl+1

Publicado 2014-03-25 · Atualizado 2017-10-24 · CVE-2014-2538

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions rack-ssl gem versions prior to 1.4.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via a URI. This might not be properly handled by third-party adapters such as JRuby-Rack.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/rack/ssl.rb file until a patch is available. Avoid using URIs that might be improperly handled by third-party adapters.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-2538

GHSA-V3RR-CPH9-2G2Q

MGASA-2014-0156

SUSE-SU-2014_0730-2

Produtos afetados

Suse

Rack-Ssl

Referências · 24

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-ssl/CVE-2014-2538.yml · Exploit
• ❌ https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b · Correção, Deleted
• http://lists.opensuse.org/opensuse-updates/2014-04/msg00032.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2538 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2014-0156.html · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/03/19/20 · Nota
• https://bugzilla.novell.com/869162 · Nota
• https://osv.dev/vulnerability/GHSA-v3rr-cph9-2g2q · Aviso do Fabricante
• ❌ https://github.com/josh/rack-ssl · Nota, Deleted
• https://web.archive.org/web/20140524002455/http://secunia.com/advisories/57466 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://web.archive.org/web/20200228185649/http://securityfocus.com/bid/66314 · Nota
• http://download.suse.com/patch/finder/?keywords=2de6450fdeda964ef77efb5062253dc3 · Nota
• https://osv.dev/vulnerability/CVE-2014-2538 · Aviso do Fabricante
• http://securityfocus.com/bid/66314 · Nota