Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to
    perform CORS requests. If the configuration were intended to allow only the trusted example.com domain
    name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-
    example.net) would be inadvertently allowed. (CVE-2017-11173)

Jens Mueller discovered that an incorrect regular expression in rack-cors may lead to insufficient restriction of CORS requests.

Security fix for CVE-2017-11173, new upstream version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422445	SCA: security update for rack-cors (GHSA-2j9c-9vmv-7m39)	Tenable Cloud Security	SCA Checks	high
422445	SCA: security update for rack-cors (GHSA-2j9c-9vmv-7m39)	Tenable Self-Hosted Container Security	SCA Checks	high
103792	Debian DSA-3931-1 : ruby-rack-cors - security update	Nessus	Debian Local Security Checks	high
102006	Fedora 25 : rubygem-rack-cors (2017-c22a8af4e9)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-11173

high

Tenable Plugins

high

high

high

high