USN-4561-2

Details

USN-4561-1 fixed vulnerabilities in Rack. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 20.04 LTS and Ubuntu 20.10.

Original advisory details:

It was discovered that Rack incorrectly handled certain paths. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8161)

It was discovered that Rack incorrectly validated cookies. An attacker could possibly use this issue to forge a secure cookie. (CVE-2020-8184)

Affected Packages

ruby-rack

Ubuntu 16.04 LTS

Fixed in:

1.6.4-3ubuntu0.2

ruby-rack

Ubuntu 20.04 LTS

Fixed in:

2.0.7-2ubuntu0.1

References

REPORT

https://ubuntu.com/security/CVE-2020-8161

REPORT

https://ubuntu.com/security/CVE-2020-8184

ADVISORY

https://ubuntu.com/security/notices/USN-4561-2