Summary
It was discovered that Rack incorrectly handled carefully crafted requests. A
remote attacker could use this issue to execute a cross-site scripting (XSS)
attack.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | ruby-rack | 1.6.4-3ubuntu0.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | ruby-rack | 1.6.4-4ubuntu0.1 |
Vulnerabilities 1
-
Medium 6.1
Rack vulnerable to Cross-site Scripting
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape …
References
-
report
https://ubuntu.com/security/CVE-2018-16471