Описание
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
Отчет
This issue affects the versions of rubygem-rack-protection as shipped with Red Hat Satellite 6. Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 1.3 | rubygem-rack-protection | Will not fix | ||
| Red Hat Enterprise Linux 6 | pcs | Will not fix | ||
| Red Hat Enterprise Linux 8 | rubygem-rack-protection | Not affected | ||
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools | rubygem-rack-protection | Will not fix | ||
| Red Hat OpenStack Platform 10 (Newton) Operational Tools | rubygem-rack-protection | Will not fix | ||
| Red Hat OpenStack Platform 11 (Ocata) Operational Tools | rubygem-rack-protection | Will not fix | ||
| Red Hat OpenStack Platform 12 (Pike) Operational Tools | rubygem-rack-protection | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) Operational Tools | rubygem-rack-protection | Will not fix | ||
| Red Hat OpenStack Platform 8 (Liberty) Operational Tools | rubygem-rack-protection | Will not fix | ||
| Red Hat OpenStack Platform 9 (Mitaka) Operational Tools | rubygem-rack-protection | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier conta ...
rack-protection gem timing attack vulnerability when validating CSRF token
Уязвимость механизма защиты «rack-protection» фреймворка Sinatra для разработки веб-приложений на языке программирования Ruby, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
3.7 Low
CVSS3