CVE-2012-2671 Rack-Cache caches sensitive headers
HighCVSS 7.5
EPSS 2.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rack-cache(RubyGems) | >= 0.3.0, < 1.2 | 1.2 |
| rubygems rack-cache(RubyGems) | = 0.3.0 | No fix listed |
| rubygems rack-cache(RubyGems) | = 0.4 | No fix listed |
| rubygems rack-cache(RubyGems) | = 0.5 | No fix listed |
| rubygems rack-cache(RubyGems) | = 0.5.2 | No fix listed |
| rubygems rack-cache(RubyGems) | = 0.5.3 | No fix listed |
| rubygems rack-cache(RubyGems) | = 1.0 | No fix listed |
| rubygems rack-cache(RubyGems) | = 1.0.1 | No fix listed |
| rubygems rack-cache(RubyGems) | = 1.0.2 | No fix listed |
| rubygems rack-cache(RubyGems) | = 1.0.3 | No fix listed |
| rubygems rack-cache(RubyGems) | = 1.1 | No fix listed |
| debian/ruby-rack-cache(Debian:12) | < 1.2-1 | 1.2-1 |
| debian/ruby-rack-cache(Debian:13) | < 1.2-1 | 1.2-1 |
| debian/ruby-rack-cache(Debian:14) | < 1.2-1 | 1.2-1 |
| rtomayko rack-cach | = 0.3.0 | No fix listed |
| rtomayko rack-cach | = 0.4 | No fix listed |
| rtomayko rack-cach | = 0.5 | No fix listed |
| rtomayko rack-cach | = 0.5.2 | No fix listed |
| rtomayko rack-cach | = 0.5.3 | No fix listed |
| rtomayko rack-cach | = 1.0 | No fix listed |
| rtomayko rack-cach | = 1.0.1 | No fix listed |
| rtomayko rack-cach | = 1.0.2 | No fix listed |
| rtomayko rack-cach | = 1.0.3 | No fix listed |
| rtomayko rack-cach | = 1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugzilla.redhat.com
- github.com
- FEDORA-2012-8439 vendor-advisory
- [oss-security] 20120606 CVE request: rack-cache caches sensitive headers (Set-Cookie) mailing-list
- [oss-security] 20120606 Re: CVE request: rack-cache caches sensitive headers (Set-Cookie) mailing-list
- bugzilla.novell.com
- github.com exploit
- github.com
- Debian Security Tracker CVE-2012-2671 vendor-advisory