CVE-2018-16471

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.

There is a possible XSS vulnerability in Rack. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request.Applications that expect the scheme to be limited to "http" or "https" and do not escape the return value could be vulnerable to an XSS attack (CVE-2018-16471).

This update for rubygem-rack to version 2.0.8 fixes the following issues:

• CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw via the scheme method on Rack::Request (bsc#1116600).
• CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability (bsc#1159548).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the ruby2.7-rubygem-rack-2.2.3-1.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby2.7-rubygem-rack-2.0-2.0.9-1.10 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-rack-2.2.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-rack-2.2-2.2.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-rack-3.0.7-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.

This update for rubygem-rack fixes the following issues:

Security issued fixed:

• CVE-2018-16471: Fixed a cross-site scripting vulnerability via 'scheme' method (bsc#1116600).

This update for rubygem-rack to version 2.0.8 fixes the following issues:

• CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw via the scheme method on Rack::Request (bsc#1116600).
• CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability (bsc#1159548).

It was discovered that Rack incorrectly handled carefully crafted requests. A remote attacker could use this issue to execute a cross-site scripting (XSS) attack.