UBUNTU-CVE-2020-8184

Details

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Affected Packages

ruby-rack

Ubuntu 16.04 LTS

Fixed in:

1.6.4-3ubuntu0.2

ruby-rack

Ubuntu 18.04 LTS

Fixed in:

1.6.4-4ubuntu0.2

ruby-rack

Ubuntu 20.04 LTS

Fixed in:

2.0.7-2ubuntu0.1

ruby-rack

Ubuntu Pro 14.04 LTS

Fixed in:

1.5.2-3+deb8u3ubuntu1~esm4

References

REPORT

https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak

REPORT

https://hackerone.com/reports/895727

REPORT

https://ubuntu.com/security/CVE-2020-8184

ADVISORY

https://ubuntu.com/security/notices/USN-4561-1

ADVISORY

https://ubuntu.com/security/notices/USN-4561-2

ADVISORY

https://ubuntu.com/security/notices/USN-5253-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2020-8184