Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby
    allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly
    handled by third-party adapters such as JRuby-Rack. (CVE-2014-2538)

This rubygem-rack-ssl updated fixes the following security issue :

  - bnc#869162: Fixed XSS in error page (CVE-2014-2538).

Handle bad URIs gracefully (CVE-2014-2538).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
423245	SCA: security update for rack-ssl (GHSA-v3rr-cph9-2g2q)	Tenable Cloud Security	SCA Checks	medium
423245	SCA: security update for rack-ssl (GHSA-v3rr-cph9-2g2q)	Tenable Self-Hosted Container Security	SCA Checks	medium
75323	openSUSE Security Update : rubygem-rack-ssl (openSUSE-SU-2014:0515-1)	Nessus	SuSE Local Security Checks	medium
73313	Fedora 20 : rubygem-rack-ssl-1.3.2-9.fc20 (2014-4118)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-2538

medium

Tenable Plugins

medium

medium

medium

medium