Lucene search

RubySecRUBY:RACK-2013-0263-89939

HistoryFeb 06, 2013 - 8:00 p.m.

CVE-2013-0263 rubygem-rack: Timing attack in cookie sessions

2013-02-0620:00:00

RubySec

rubysec.com

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.084 Low

EPSS

Percentile

94.4%

JSON

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5,
1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers
to guess the session cookie, gain privileges, and execute arbitrary code via a timing
attack involving an HMAC comparison function that does not run in constant time.

CPENameOperatorVersion
rackle1.1.5
rackge1.2.0
rackle1.2.7
rackge1.3.0
rackle1.3.9
rackge1.4.0
rackle1.4.4
rackge1.5.0
racklt1.5.2

Name	Operator	Version
rack	le	1.1.5
rack	ge	1.2.0
rack	le	1.2.7
rack	ge	1.3.0
rack	le	1.3.9
rack	ge	1.4.0
rack	le	1.4.4
rack	ge	1.5.0
rack	lt	1.5.2

References

nvd.nist.gov/vuln/detail/CVE-2013-0263

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.084 Low

EPSS

Percentile

94.4%

JSON

Related for RUBY:RACK-2013-0263-89939