Skip to content
OpenAdvisories
Medium · 6.3 CVE-2019-16782 EUVD-2019-0795GHSA-hrqr-hxpp-chr3

Possible Information Leak / Session Hijack Vulnerability in Rack

Published Dec 18, 2019 · Updated Aug 5, 2024 · Assigned by GitHub_M

Vendor: rack Product: rack Package: rack Package: ruby-rack Package: ruby-rack Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Affected products

VendorProductAffectedFixed
rack rack before 1.6.12 or 2.0.8 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-rack 2.1.1-2 —
Debian 13 ruby-rack 2.1.1-2 —
Debian 12 ruby-rack 2.1.1-2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS ruby-rack 2.0.7-2ubuntu0.1+esm1 USN-5253-1
Ubuntu Pro 18.04 LTS ruby-rack 1.6.4-4ubuntu0.2+esm1 USN-5253-1
Ubuntu Pro 16.04 LTS ruby-rack 1.6.4-3ubuntu0.2+esm1 USN-5253-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS ruby-rack 1.5.2-3+deb8u3ubuntu1~esm3 USN-5253-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite +1 1.3.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 ansible-runner +1 1.4.6-1.el7ar RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 ansiblerole-foreman_scap_client 0.0.5-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 ansiblerole-insights-client 1.7.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 ansiblerole-satellite-receptor-installer 0.6.13-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 crane-selinux +1 3.4.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 createrepo_c +1 0.7.4-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 foreman +1 2.1.2.19-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 202005201200-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 foreman-discovery-image 1:3.6.7-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 foreman-discovery-image-service +1 1.0.0-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 foreman-installer +1 1:2.1.2.8-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 foreman-proxy +1 2.1.2-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 foreman-selinux +1 2.3.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 future +1 0.16.0-11.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 gofer +2 2.12.5-7.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 hfsplus-tools 332.14-12.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 katello +3 3.16.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 katello-certs-tools 2.7.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.7.5-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 kobo 0.5.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 libmodulemd 1.7.0-1.pulp.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 libsolv +1 0.7.4-4.pulp.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 libwebsockets 2.4.2-2.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 livecd-tools +1 1:20.4-1.6.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 mod_xsendfile 0.12-11.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 ostree 2017.1-2.atomic.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 pulp +14 2.21.3-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 pulp-docker +3 3.2.7-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 pulp-katello 1.0.3-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 pulp-ostree +3 1.3.1-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 pulp-rpm +8 2.21.3-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 puppet-agent 6.14.0-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 puppet-agent-oauth 0.5.1-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 0.4.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 puppetlabs-stdlib 4.25.1-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 puppetserver 6.13.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 pycairo 1.16.3-9.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 pygobject3 +2 3.28.3-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-amqp +1 2.2.2-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-anyjson +1 0.3.3-11.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-apypie +1 0.2.2-1.el7sat RHSA-2020:4366
Red Hat Satellite Capsule 6 python-billiard +1 1:3.5.0.3-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-blinker 1.3-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-bson +2 3.2-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-celery +1 4.0.2-9.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-click +1 6.7-9.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-crane +1 3.3.1-9.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-daemon +1 2.1.2-7.el7at RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-django +1 1.11.29-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-flask +1 1:0.12.2-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-gnupg 0.3.7-1.el7ui RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-isodate +1 0.5.4-12.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-itsdangerous +1 0.24-15.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-jinja2 +1 2.10-10.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-jmespath +1 0.9.0-6.el7_7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-kid 0.9.6-11.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-kombu +1 10:4.0.2-13.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-lockfile +1 1:0.11.0-10.el7ar RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-markupsafe +1 0.23-21.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-mongoengine 0.10.5-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-nectar 1.6.2-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-oauth2 1.5.211-8.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-okaara +1 1.0.37-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-pexpect +1 4.6-1.el7at RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-psutil 5.0.1-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-ptyprocess +1 0.5.2-3.el7at RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-pycurl +1 7.43.0.2-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-qpid 1.35.0-5.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-semantic_version 2.2.0-6.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-simplejson 3.2.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-twisted +1 16.4.1-12.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-vine +1 10:1.1.3-6.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-werkzeug +1 0.12.2-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python-zope-interface 4.0.5-4.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 python2-psutil 5.7.2-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 qpid-cpp +6 1.36.0-28.el7amq RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 qpid-dispatch +2 1.5.0-4.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 qpid-proton +2 0.28.0-3.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 redhat-access-insights-puppet 1.0.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 repoview 0.6.6-11.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 rubygem-fast_gettext 1.1.0-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 rubygem-highline 1.7.8-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 rubygem-newt 0.9.6-3.el7sat RHSA-2020:4366
Red Hat Satellite Capsule 6 rubygem-oauth 0.5.4-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 saslwrapper +1 0.22-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 satellite +3 6.8.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 satellite-installer 6.8.0.11-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm +1 6.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-algebrick 0.7.3-6.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-ansi 1.5.0-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-apipie-params 0.0.5-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-bundler_ext 0.4.1-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-clamp 1.1.2-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-concurrent-ruby 1:1.1.6-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-concurrent-ruby-edge 1:0.6.0-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-domain_name 0.5.20160310-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-dynflow 1.4.7-1.fm2_1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-excon 0.76.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-faraday 0.15.4-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-faraday_middleware 0.13.1-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-fast_gettext 1.4.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-ffi 1.12.2-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-foreman-tasks-core 0.3.4-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-foreman_ansible_core 3.0.4-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-gssapi 1.2.0-6.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-hashie 3.6.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-highline 1.7.8-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-http-cookie 1.0.2-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-infoblox 3.0.0-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-journald-logger 2.0.4-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-journald-native 1.0.11-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-jwt 2.2.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-kafo 4.1.0-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-kafo_parsers 1.1.0-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-kafo_wizards 0.0.1-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-little-plugger 1.1.4-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-logging 2.2.2-6.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-logging-journald 2.0.0-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-mime-types 3.2.2-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-mime-types-data 3.2018.0812-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-multi_json 1.14.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-multipart-post 2.0.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-mustermann 1.0.2-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-net-ssh 4.2.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-net-ssh-krb 0.4.0-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-netrc 0.11.0-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-newt 0.9.7-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-openscap 0.4.9-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-powerbar 2.0.1-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-rack 2.2.3-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-rb-inotify 0.9.7-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-redfish_client 0.5.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rest-client 2.0.2-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-rkerberos 0.1.5-18.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-rsec 0.4.3-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-ruby-libvirt 0.7.0-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-rubyipmi 0.10.0-6.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-sd_notify 0.1.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sequel 5.7.1-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-server_sent_events 0.1.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sinatra +1 2.0.3-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_ansible 3.0.1-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dhcp_infoblox 0.0.16-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dhcp_remote_isc 0.0.5-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_discovery 1.0.5-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_discovery_image 1.2.1-1.fm2_1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dns_infoblox 1.0.0-7.fm2_1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dynflow 0.2.4-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dynflow_core 0.2.6-1.fm2_1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_openscap 0.7.3-1.fm2_1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_pulp 2.1.0-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_remote_execution_ssh 0.3.0-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-sqlite3 1.3.13-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-statsd-instrument 2.1.4-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-tilt 2.0.8-4.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-unf 0.1.3-7.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-unf_ext 0.0.7.2-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite Capsule 6 tfm-rubygem-xmlrpc 0.3.0-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 ansible-collection-redhat-satellite 1.3.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 ansible-runner 1.4.6-1.el7ar RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 ansiblerole-foreman_scap_client 0.0.5-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 ansiblerole-insights-client 1.7.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 ansiblerole-satellite-receptor-installer 0.6.13-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 candlepin +1 3.1.21-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 crane-selinux +1 3.4.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 createrepo_c +1 0.7.4-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 foreman +13 2.1.2.19-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 foreman-bootloaders-redhat +1 202005201200-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 foreman-discovery-image 1:3.6.7-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 foreman-discovery-image-service +1 1.0.0-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 foreman-installer +1 1:2.1.2.8-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 foreman-proxy +1 2.1.2-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 foreman-selinux 2.1.2.3-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 future 0.16.0-11.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 gofer +2 2.12.5-7.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 hfsplus-tools 332.14-12.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 katello +3 3.16.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 katello-certs-tools 2.7.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 katello-client-bootstrap 1.7.5-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 keycloak-httpd-client-install 1.2.2-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 kobo 0.5.1-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 libcomps 0.1.15-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 libmodulemd 1.7.0-1.pulp.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 libmodulemd2 2.9.3-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 libsolv 0.7.4-4.pulp.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 libwebsockets 2.4.2-2.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 livecd-tools +1 1:20.4-1.6.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 mod_passenger 4.0.18-24.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 mod_xsendfile 0.12-11.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 ostree 2017.1-2.atomic.el7 RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pcp-mmvstatsd 0.4-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pulp +4 2.21.3-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pulp-docker +2 3.2.7-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pulp-katello 1.0.3-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pulp-ostree +2 1.3.1-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pulp-rpm +6 2.21.3-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pulpcore-selinux 1.2.3-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 puppet-agent 6.14.0-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 puppet-agent-oauth 0.5.1-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 puppet-foreman_scap_client 0.4.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 puppetlabs-stdlib 4.25.1-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 puppetserver 6.13.0-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pycairo 1.16.3-9.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 pygobject3 3.28.3-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-aiodns 2.0.0-3.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-aiofiles +1 0.6.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-aiohttp 3.6.2-4.el7ar RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-amqp 2.2.2-5.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-anyjson 0.3.3-11.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-apypie 0.2.2-1.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-async-timeout 3.0.1-2.el7ar RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-attrs 19.3.0-2.el7pc RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-backoff 1.10.0-3.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-billiard 1:3.5.0.3-3.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-blinker 1.3-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-bson 3.2-2.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-celery 4.0.2-9.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-certifi 2020.6.20-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-cffi 1.14.3-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-chardet 3.0.4-10.el7ar RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-click 6.7-9.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-crane 3.3.1-9.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-cryptography 2.9.2-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-daemon 2.1.2-7.el7at RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-dateutil 2.8.1-2.el7ar RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-diff-match-patch 20200713-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django 1.11.29-1.el7sat RHSA-2021:1313, RHSA-2020:4366
Red Hat Satellite 6 python-django-currentuser 0.5.1-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-filter +2 2.3.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-lifecycle 0.8.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-prometheus 2.1.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-flask 1:0.12.2-4.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-gnupg 0.3.7-1.el7ui RHSA-2020:4366
Red Hat Satellite 6 python-idna 2.4-2.el7ar RHSA-2020:4366
Red Hat Satellite 6 python-idna-ssl 1.1.0-2.el7ar RHSA-2020:4366
Red Hat Satellite 6 python-isodate 0.5.4-12.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-itsdangerous 0.24-15.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-jinja2 2.10-10.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-jmespath 0.9.0-6.el7_7 RHSA-2020:4366
Red Hat Satellite 6 python-kid 0.9.6-11.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-kombu 10:4.0.2-13.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-lockfile 1:0.11.0-10.el7ar RHSA-2020:4366
Red Hat Satellite 6 python-markupsafe 0.23-21.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-mongoengine 0.10.5-2.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-multidict 4.7.4-2.el7ar RHSA-2020:4366
Red Hat Satellite 6 python-nectar 1.6.2-1.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-oauth2 1.5.211-8.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-okaara 1.0.37-2.el7sat RHSA-2020:4366
Red Hat Satellite 6 python-pexpect 4.6-1.el7at RHSA-2020:4366
Red Hat Satellite 6 python-prometheus-client 0.7.1-2.el7ar RHSA-2020:4366
Red Hat Satellite 6 python-psutil 5.0.1-3.el7sat RHSA-2020:4366
Red Hat CloudForms 5 ansible-runner +1 1.4.6-1.el8ar RHSA-2020:2480
Red Hat CloudForms 5 cfme +5 5.11.6.0-1.el8cf RHSA-2020:2480
Red Hat CloudForms 5 libssh2 1.9.0-2.el8cf RHSA-2020:2480

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP1 rubygem-rack 2.0.8-3.3.1 SUSE-SU-2020:0359-1
SLES 15 rubygem-rack 2.0.8-3.3.1 SUSE-SU-2020:0359-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 9 rubygem-actionpack-4_2 4.2.9-7.9.1 SUSE-SU-2021:1162-1
SUSE OpenStack Cloud Crowbar 9 rubygem-rack 1.6.13-3.8.1 SUSE-SU-2020:2678-1
SUSE OpenStack Cloud Crowbar 8 rubygem-actionpack-4_2 4.2.9-7.9.1 SUSE-SU-2021:1162-1
SUSE OpenStack Cloud Crowbar 8 rubygem-rack 1.6.13-3.8.1 SUSE-SU-2020:2678-1
SUSE OpenStack Cloud 7 rubygem-actionpack-4_2 4.2.9-7.9.1 SUSE-SU-2021:1162-1
SUSE OpenStack Cloud 7 rubygem-rack 1.6.13-3.8.1 SUSE-SU-2020:2678-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ruby3.2-rubygem-rack 3.0.7-1.2 openSUSE-SU-2024:13167-1
openSUSE Tumbleweed ruby3.2-rubygem-rack-2.2 2.2.7-1.1 openSUSE-SU-2024:12974-1
openSUSE Tumbleweed rubygem-actionpack-6.0 6.0.4.4-1.1 openSUSE-SU-2024:11821-1
openSUSE Tumbleweed rubygem-rack 2.2.3.1-1.1 openSUSE-SU-2026:10358-1, openSUSE-SU-2025:14875-1, openSUSE-SU-2024:13726-1
openSUSE Tumbleweed rubygem-rack-2.2 2.2.4-1.1 openSUSE-SU-2026:10286-1, openSUSE-SU-2025:14811-1, openSUSE-SU-2024:13727-1
openSUSE Leap 15.1 rubygem-rack 2.0.8-lp151.3.3.1 openSUSE-SU-2020:0214-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems rack < 1.6.12 1.6.12 GHSA-hrqr-hxpp-chr3
RubyGems rack >= 2.0.0, < 2.0.8 2.0.8 GHSA-hrqr-hxpp-chr3

Advisories 20

References