Filtered by vendor Rack Subscriptions
Total 23 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-16782 4 Fedoraproject, Opensuse, Rack and 1 more 6 Fedora, Leap, Rack and 3 more 2025-02-13 6.3 Medium
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
CVE-2023-27530 3 Debian, Rack, Redhat 6 Debian Linux, Rack, Enterprise Linux and 3 more 2025-02-13 7.5 High
A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.
CVE-2024-35231 1 Rack 1 Rack-contrib 2024-11-21 8.6 High
rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.