PT-2014-4770 · Ruby+1 · Rack-Ssl+1

Published 2014-03-25 · Updated 2017-10-24 · CVE-2014-2538

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions rack-ssl gem versions prior to 1.4.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via a URI. This might not be properly handled by third-party adapters such as JRuby-Rack.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/rack/ssl.rb file until a patch is available. Avoid using URIs that might be improperly handled by third-party adapters.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-2538

GHSA-V3RR-CPH9-2G2Q

MGASA-2014-0156

SUSE-SU-2014_0730-2

Affected Products

Suse

Rack-Ssl

References · 24

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-ssl/CVE-2014-2538.yml · Exploit
• ❌ https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b · Patch, Deleted
• http://lists.opensuse.org/opensuse-updates/2014-04/msg00032.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2538 · Security Note
• https://advisories.mageia.org/MGASA-2014-0156.html · Security Note
• https://osv.dev/vulnerability/GHSA-v3rr-cph9-2g2q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-2538 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-April/130990.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2538 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2538 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0156 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-2538 · Vendor Advisory
• http://secunia.com/advisories/57466 · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/03/19/20 · Note
• https://bugzilla.novell.com/869162 · Note