CVE-2013-0263

2013-02-0800:00:00

ubuntu.com

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.084 Low

EPSS

Percentile

94.3%

JSON

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x
before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote
attackers to guess the session cookie, gain privileges, and execute
arbitrary code via a timing attack involving an HMAC comparison function
that does not run in constant time.

OSVersionArchitecturePackageVersionFilename
ubuntu13.10noarchruby-rack< 1.5.2-1UNKNOWN
ubuntu14.04noarchruby-rack< 1.5.2-1UNKNOWN
ubuntu14.10noarchruby-rack< 1.5.2-1UNKNOWN
ubuntu15.04noarchruby-rack< 1.5.2-1UNKNOWN
ubuntu15.10noarchruby-rack< 1.5.2-1UNKNOWN
ubuntu16.04noarchruby-rack< 1.5.2-1UNKNOWN
ubuntu16.10noarchruby-rack< 1.5.2-1UNKNOWN
ubuntu17.04noarchruby-rack< 1.5.2-1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	13.10	noarch	ruby-rack	< 1.5.2-1	UNKNOWN
ubuntu	14.04	noarch	ruby-rack	< 1.5.2-1	UNKNOWN
ubuntu	14.10	noarch	ruby-rack	< 1.5.2-1	UNKNOWN
ubuntu	15.04	noarch	ruby-rack	< 1.5.2-1	UNKNOWN
ubuntu	15.10	noarch	ruby-rack	< 1.5.2-1	UNKNOWN
ubuntu	16.04	noarch	ruby-rack	< 1.5.2-1	UNKNOWN
ubuntu	16.10	noarch	ruby-rack	< 1.5.2-1	UNKNOWN
ubuntu	17.04	noarch	ruby-rack	< 1.5.2-1	UNKNOWN