There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.

This update for rubygem-rack to version 2.0.8 fixes the following issues :

  - CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw     via the scheme method on Rack::Request (bsc#1116600).

  - CVE-2019-16782: Fixed a possible information leak and     session hijack vulnerability (bsc#1159548).

This update was imported from the SUSE:SLE-15:Update update project.

This update for rubygem-rack to version 2.0.8 fixes the following issues :

CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw via the scheme method on Rack::Request (bsc#1116600).

CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability (bsc#1159548).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Rack incorrectly handled carefully crafted requests. A remote attacker could use this issue to execute a cross-site scripting (XSS) attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-rack fixes the following issues :

Security issued fixed :

  - CVE-2018-16471: Fixed a cross-site scripting     vulnerability via 'scheme' method (bsc#1116600).

This update was imported from the SUSE:SLE-12:Update update project.

- Buffer size in multipart parser allows for denial of     service (CVE-2018-16470).

  - Cross-site scripting (XSS) via `scheme` method on     `Rack::Request` (CVE-2018-16471).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Cross-site scripting (XSS) via `scheme` method on     `Rack::Request` (CVE-2018-16471).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an XSS vulnerability in the ruby-rack web-server library.

A malicious request could impact the HTTP/HTTPS scheme being returned to the underlying application.

For Debian 8 'Jessie', this issue has been fixed in ruby-rack version 1.5.2-3+deb8u2.

We recommend that you upgrade your ruby-rack packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
133669	openSUSE Security Update : rubygem-rack (openSUSE-2020-214)	Nessus	SuSE Local Security Checks	medium
133597	SUSE SLED15 / SLES15 Security Update : rubygem-rack (SUSE-SU-2020:0359-1)	Nessus	SuSE Local Security Checks	medium
127805	Ubuntu 16.04 LTS / 18.04 LTS : Rack vulnerability (USN-4089-1)	Nessus	Ubuntu Local Security Checks	medium
125919	openSUSE Security Update : rubygem-rack (openSUSE-2019-1553)	Nessus	SuSE Local Security Checks	medium
120874	Fedora 29 : 1:rubygem-rack (2018-e8ff8b7f8e)	Nessus	Fedora Local Security Checks	medium
120205	Fedora 28 : 1:rubygem-rack (2018-02e965a729)	Nessus	Fedora Local Security Checks	medium
119245	Fedora 27 : 1:rubygem-rack (2018-5743ef02a1)	Nessus	Fedora Local Security Checks	medium
119102	Debian DLA-1585-1 : ruby-rack security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-16471

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium