Detections
Analytics
SCA: security update for rack (GHSA-vpfw-47h7-xj4g)
medium Tenable Cloud Security Plugin ID 434720
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool`
middleware, simultaneous rack requests can restore a deleted rack session, which allows the
unauthenticated user to occupy that session. Rack session middleware prepares the session at the beginning
of request, then saves is back to the store with possible changes applied by host rack application. This
way the session becomes to be a subject of race conditions in general sense over concurrent rack requests.
When using the `Rack::Session::Pool` middleware, and provided the attacker can acquire a session cookie
(already a major issue), the session may be restored if the attacker can trigger a long running request
(within that same session) adjacent to the user logging out, in order to retain illicit access even after
a user has attempted to logout. Version 2.2.14 contains a patch for the issue. Some other mitigations are
available. Either ensure the application invalidates sessions atomically by marking them as logged out
e.g., using a `logged_out` flag, instead of deleting them, and check this flag on every request to prevent
reuse; or implement a custom session store that tracks session invalidation timestamps and refuses to
accept session data if the session was invalidated after the request began. (CVE-2025-32441)
See Also
Plugin Details
Severity: Medium
ID: 434720
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 8/19/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.1
Percentile: 7.67
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Low
Base Score: 3.6
Temporal Score: 2.7
Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2025-32441
CVSS v3
Risk Factor: Medium
Base Score: 4.2
Temporal Score: 3.7
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/8/2025
Vulnerability Publication Date: 5/1/2025
Reference Information
CVE: CVE-2025-32441