CVE-2024-26144

2024-02-2700:00:00

ubuntu.com

rails framework

active storage

sensitive information leak

set-cookie header

proxies

information security

version 5.2.0

version 7.0.8.1

version 6.1.7.7

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.7

Confidence

Low

EPSS

Percentile

10.3%

JSON

Rails is a web-application framework. Starting with version 5.2.0, there is
a possible sensitive session information leak in Active Storage. By
default, Active Storage sends a Set-Cookie header along with the user’s
session cookie when serving blobs. It also sets Cache-Control to public.
Certain proxies may cache the Set-Cookie, leading to an information leak.
The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Notes

Author	Note
seth-arnold	In Oneiric-Saucy, rails package is just for transition; The rails package contains actual code from vivid onward

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchrails< anyUNKNOWN
ubuntu20.04noarchrails< anyUNKNOWN
ubuntu22.04noarchrails< anyUNKNOWN
ubuntu24.04noarchrails< anyUNKNOWN
ubuntu16.04noarchrails< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	rails	< any	UNKNOWN
ubuntu	20.04	noarch	rails	< any	UNKNOWN
ubuntu	22.04	noarch	rails	< any	UNKNOWN
ubuntu	24.04	noarch	rails	< any	UNKNOWN
ubuntu	16.04	noarch	rails	< any	UNKNOWN