Description
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2.2.3-1 | — |
| Debian 13 | rails | 2.2.3-1 | — |
| Debian 12 | rails | 2.2.3-1 | — |
| Debian 5.0 | rails | 2.1.0-7+lenny0.2 | DSA-2260-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | actionpack | >= 2.1.0, < 2.2.3 | 2.2.3 | GHSA-fg9w-g6m4-557j |
| RubyGems | actionpack | >= 2.3.0, < 2.3.4 | 2.3.4 | GHSA-fg9w-g6m4-557j |
| RubyGems | activesupport | >= 2.1.0, < 2.2.3 | 2.2.3 | GHSA-fg9w-g6m4-557j |
| RubyGems | activesupport | >= 2.3.0, < 2.3.4 | 2.3.4 | GHSA-fg9w-g6m4-557j |
Advisories 1
- DSA-2260-1 rails - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 36600 third-party-advisory
- 37427 vdb-entry
- ADV-2009-2544 vdb-entry
- DSA-2260 vendor-advisory
- http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
- SUSE-SR:2009:017 vendor-advisory