Skip to content
OpenAdvisories
High DSA-3931-1 1 CVE

ruby-rack-cors - security update

Published Aug 10, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 ruby-rack-cors 0.4.0-1+deb9u1

Vulnerabilities 1

  • High 8.8
    CVE-2017-11173

    Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request

    Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then…

    rack-cors ruby-rack-cors ruby-rack-cors Debian Ubuntu RubyGems