HIGH7.5

GHSA-j6w9-fv6q-3q52

Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

Quick fix

GHSA-j6w9-fv6q-3q52 — rack: upgrade to the fixed version with the command below.

bundle update rack

Details

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/rack

Introduced in: 0Fixed in: 2.1.4

Fixbundle update rack

RubyGems/rack

Introduced in: 2.2.0Fixed in: 2.2.3

Fixbundle update rack

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8184[ADVISORY]
https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c[WEB]
https://hackerone.com/reports/895727[WEB]
https://github.com/rack/rack[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8184.yml[WEB]
https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak[WEB]
https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html[WEB]
https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html[WEB]
https://usn.ubuntu.com/4561-1[WEB]