Important: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

rubygem-rack: crafted requests can cause shell escape sequences

A flaw was found in ruby gem-rack. This flaw allows a malicious actor to craft requests that can cause shell escape sequences to be written to the terminal via rack's Lint middleware and CommonLogger middleware. This issue can leverage these escape sequences to execute commands in the victim's...

SUSE SLES15: ruby2.5-rubygem-rack / ruby2.5-rubygem-rack-doc / etc (SUSE-SU-2022:3347-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3347-1 advisory. - CVE-2020-8184: Fixed vulnerability where percent-encoded cookies can be used to overwrite existing prefixed cookie names...

SUSE-SU-2022:3347-1 Security update for rubygem-rack

This update for rubygem-rack fixes the following issues: - CVE-2020-8184: Fixed vulnerability where percent-encoded cookies can be used to overwrite existing prefixed cookie names bsc1173351. - CVE-2020-8161: Fixed directory traversal in Rack:Directory bsc1172037...

SUSE-SU-2022:2526-1 Security update for rubygem-rack

This update for rubygem-rack fixes the following issues: - CVE-2022-30122: Fixed crafted multipart POST request may cause a DoS bsc1200748 - CVE-2022-30123: Fixed crafted requests can cause shell escape sequences bsc1200750 The following non-security bug was fixed: - Fixed a regression in...

ROS-20220706-02

The Rubygem Rack web application development interface vulnerability is related to incorrect input validation when processing data transmitted through the Rack Lint middleware and CommonLogger middleware. Exploitation of the vulnerability could allow an attacker acting remotely to send specially...

SUSE SLES15 Security Update : rubygem-rack (SUSE-SU-2022:2192-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2192-1 advisory. - A possible denial of service vulnerability exists in Rack 2.0.9.1, 2.1.4.1 and 2.2.3.1 in the multipart parsing component of Rack...

openSUSE: Security Advisory for rubygem-rack (SUSE-SU-2022:2192-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:2192-1 Security update for rubygem-rack

This update for rubygem-rack fixes the following issues: - CVE-2022-30122: Fixed crafted multipart POST request may cause a DoS bsc1200748 - CVE-2022-30123: Fixed crafted requests can cause shell escape sequences bsc1200750...

RubyGem Rack 资源管理错误漏洞

RubyGem Rack is a modular interface between a web server and a web application developed using the Ruby programming language. RubyGem Rack suffers from a resource management error vulnerability. An attacker could exploit this vulnerability to cause a fatal error in RubyGem Rack via a Multipart PO...

RubyGem Rack 安全漏洞

RubyGem Rack is a modular interface between a web server and a web application developed using the Ruby programming language. A security vulnerability exists in RubyGem Rack that stems from the presence of a code execution issue...

SUSE: Security Advisory (SUSE-SU-2015:2190-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

rubygem-rack: hijack sessions by using timing attacks targeting the session id

A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality...

SUSE-SU-2020:2678-1 Security update for rubygem-rack

This update for rubygem-rack to version 1.6.13 fixes the following issues: - CVE-2020-8184: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names bsc1173351. - CVE-2020-8161: Fixed a directory traversal bsc1172037. - CVE-2019-16782: Fixed an...

CVE-2020-8184

A flaw was found in rubygem-rack. An attacker may be able to trick a vulnerable application into processing an insecure non-SSL or cross-origin request if they can gain the ability to write arbitrary cookies that are sent to the application. The highest threat from this vulnerability is to data...

CVE-2019-16782

A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality. Mitigation There is no mitigation for...

RubyGem Rack Path Traversal Vulnerability

RubyGem Rack is a modular interface between web servers and web applications developed using the Ruby programming language. A path traversal vulnerability exists in RubyGem Rack versions prior to 2.2.0. The vulnerability stems from a failure of a network system or product to properly filter speci...

openSUSE Security Update : rubygem-rack (openSUSE-2020-214)

This update for rubygem-rack to version 2.0.8 fixes the following issues : - CVE-2018-16471: Fixed a cross-site scripting XSS flaw via the scheme method on Rack::Request bsc1116600. - CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability bsc1159548. This update was...

OPENSUSE-SU-2020:0214-1 Security update for rubygem-rack

This update for rubygem-rack to version 2.0.8 fixes the following issues: - CVE-2018-16471: Fixed a cross-site scripting XSS flaw via the scheme method on Rack::Request bsc1116600. - CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability bsc1159548. This update was...

Security update for rubygem-rack (moderate)

openSUSE Security Update: Security update for rubygem-rack Announcement ID: openSUSE-SU-2020:0214-1 Rating: moderate References: 1114828 1116600 1159548 Cross-References: CVE-2018-16471 CVE-2019-16782 Affected Products: openSUSE Leap 15.1 An update that solves two vulnerabilities and has one erra...