CVE-2016-4442 rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects
MediumCVSS 5.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rack-mini-profiler(RubyGems) | < 0.10.1 | 0.10.1 |
| rubygems rack-mini-profiler(RubyGems) | = 0.1 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.1 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.10 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.11.pre | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.12.pre | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.13.pre | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.14.pre | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.15.pre | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.16 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.17 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.18 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.19 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.2 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.20 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.21 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.22 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.23 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.24 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.25 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.26 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.27 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.28 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.29 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.3 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rack-mini-profiler(RubyGems) | = 0.1.30 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.31 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.4 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.5 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.6 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.7 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.8 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.1.9 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.0 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.0.pre | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.1 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.2 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.3 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.4 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.5 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.6 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.7 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.8 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.9 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.9.1 | No fix listed |
| rubygems rack-mini-profiler(RubyGems) | = 0.9.9.2 | No fix listed |
| miniprofiler rack-mini-profiler | <= 0.9.9.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com release-notes third-party-advisory
- [oss-security] 20160610 Ruby gem rack-mini-profiler CVE-2016-4442 mailing-list patch third-party-advisory
- github.com
- github.com