Description
The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | ruby | 1.6.7-3woody3 | DSA-537 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | irb +6 | 1.6.8-9.EL3.2 | RHSA-2004:441 |
Advisories 2
- RHSA-2004:441 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-537 ruby - insecure file permissions Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:11128 vdb-entry signature
- DSA-537 vendor-advisory
- MDKSA-2004:128 vendor-advisory
- GLSA-200409-08 vendor-advisory
- 12290 third-party-advisory
- ruby-filestore-pstore-insecure-permission(16996) vdb-entry