{"id":"CVE-2013-0263","aliases":["DEBIAN-CVE-2013-0263","DSA-2783-1","EUVD-2022-5763","GHSA-xc85-32mf-xpv8","RHSA-2013:0638","UBUNTU-CVE-2013-0263","openSUSE-SU-2024:10115-1","openSUSE-SU-2024:10406-1","openSUSE-SU-2024:11344-1","openSUSE-SU-2024:11345-1","openSUSE-SU-2024:11346-1","openSUSE-SU-2024:12119-1","openSUSE-SU-2024:12397-1","openSUSE-SU-2024:12974-1","openSUSE-SU-2024:13167-1","openSUSE-SU-2024:13726-1","openSUSE-SU-2024:13727-1","openSUSE-SU-2025:14811-1","openSUSE-SU-2025:14875-1","openSUSE-SU-2026:10286-1","openSUSE-SU-2026:10358-1"],"status":"published","title":"Rack arbitrary code execution via timing attack","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","severity":{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05383,"percentile":0.92722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-02-08T20:00:00Z","modified":"2026-09-01T20:03:11Z","fixes":[{"ecosystem":"RubyGems","package":"rack","fixed_in":["1.5.2","1.4.5","1.3.10","1.2.8","1.1.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-rack","fixed_in":["1.4.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-rack","fixed_in":["1.4.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rack","fixed_in":["1.4.1-2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ruby-rack","fixed_in":["1.5.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.5"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.10"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.8"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"librack-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-4+squeeze1"}]}],"versions":["1.1.0-4"],"bundled":4},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}]}],"versions":["1.5.0","1.5.1"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.5"}]}],"versions":["1.4.0","1.4.1","1.4.2","1.4.3","1.4.4"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.10"}]}],"versions":["1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.8"}]}],"versions":["1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.6"}]}],"versions":["1.1.0","1.1.1","1.1.1.pre","1.1.2","1.1.3","1.1.4","1.1.5"]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.1-4.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.0-4.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.502-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-cartridge-jenkins-1.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubyem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1.8"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1.2"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-1.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-1.3"}]}],"bundled":18}],"products":[{"vendor":"rack_project","product":"rack"}],"references":[{"url":"http://secunia.com/advisories/52774","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://groups.google.com/forum/#%21msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11","tags":["x_refsource_CONFIRM","x_transferred","fix","web"]},{"url":"http://secunia.com/advisories/52033","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07","tags":["x_refsource_CONFIRM","x_transferred","fix","web"]},{"url":"http://rack.github.com/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/52134","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=909071","tags":["x_refsource_MISC","x_transferred","report","web"]},{"url":"https://groups.google.com/forum/#%21msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0686.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://puppet.com/security/cve/cve-2013-0263","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://gist.github.com/codahale/f9f3781f7b54985bee94","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://twitter.com/coda/statuses/299732877745197056","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.osvdb.org/89939","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.debian.org/security/2013/dsa-2783","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0263","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ","tags":["web"]},{"url":"https://groups.google.com/forum/#!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ","tags":["web"]},{"url":"https://groups.google.com/forum/#!msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ","tags":["web"]},{"url":"https://groups.google.com/forum/#!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xc85-32mf-xpv8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0263","tags":["advisory"]},{"url":"https://github.com/rack/rack","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0638","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=909072","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=914875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=914876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=914877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=914878","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=914879","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0638.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0262","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0262","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0263","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0263","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0327","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0327","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0328","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0328","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0328","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0329","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0330","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0331","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0331","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-0263","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/02/07","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26146","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FLQ74D2IZAJC5KD6QXVUZAQ6O5LNAWZX/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25184","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MOZFATD6SCQREBY3SZW5KQJPN6KN7A6D/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25500","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-0263","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","status":"published","published":"2013-02-08T20:00:00Z","modified":"2024-08-06T14:18:09.586Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2022-5763","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","status":"published","published":"2013-02-08T20:00:00Z","modified":"2024-08-06T14:18:09Z","updated_at":"2026-11-03T01:56:45.704567Z"}],"ghsa":[{"id":"GHSA-xc85-32mf-xpv8","title":"Rack arbitrary code execution via timing attack","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","status":"published","published":"2022-05-05T02:48:42Z","modified":"2023-02-13T16:42:06Z","updated_at":"2026-11-02T14:36:44.81167Z"}],"nvd":[{"id":"CVE-2013-0263","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","status":"published","published":"2013-02-08T20:55:01.64Z","modified":"2026-06-16T23:49:04.9Z","cvss":[{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:21.222658Z"}],"osv":[{"id":"CVE-2013-0263","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","status":"published","published":"2013-02-08T20:55:01Z","modified":"2026-03-23T05:03:55.682407Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0263","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","status":"published","published":"2013-02-08T20:55:01.64Z","modified":"2026-09-01T20:03:11.482678233Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DSA-2783-1","title":"librack-ruby - several","status":"published","published":"2013-10-21T00:00:00Z","modified":"2026-03-09T01:21:42.427647Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-xc85-32mf-xpv8","title":"Rack arbitrary code execution via timing attack","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","status":"published","published":"2022-05-05T02:48:42Z","modified":"2024-12-05T05:42:22.738151Z","updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"openSUSE-SU-2024:10115-1","title":"ruby2.2-rubygem-rack-1_4-1.4.7-1.8 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-rack-1_4-1.4.7-1.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:27.302228Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10406-1","title":"ruby2.2-rubygem-rack-1_6-1.6.5-1.1 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-rack-1_6-1.6.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:10.7272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11344-1","title":"ruby2.7-rubygem-rack-2.2.3-1.7 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-rack-2.2.3-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:23:37.231914Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11345-1","title":"ruby2.7-rubygem-rack-1_6-1.6.13-1.13 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-rack-1_6-1.6.13-1.13 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:32:39.217081Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11346-1","title":"ruby2.7-rubygem-rack-2.0-2.0.9-1.10 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-rack-2.0-2.0.9-1.10 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:52.777607Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:12119-1","title":"ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rack-2.2.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:41:57.98501Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12397-1","title":"ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:09.934016Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12974-1","title":"ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rack-2.2-2.2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:21.929927Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13167-1","title":"ruby3.2-rubygem-rack-3.0.7-1.2 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rack-3.0.7-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:45.897529Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13726-1","title":"ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:59.579529Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13727-1","title":"ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:46.684926Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:14811-1","title":"ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2026-02-04T04:22:14.520853Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14875-1","title":"ruby3.4-rubygem-rack-3.1.12-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-11T00:00:00Z","modified":"2025-05-07T18:08:49.787747Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10286-1","title":"ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-04T00:00:00Z","modified":"2026-03-23T04:54:39.054152Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10358-1","title":"ruby4.0-rubygem-rack-3.1.18-1.3 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:26:09.361493Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"RHSA-2013:0638","title":"Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1.2 update","status":"published","published":"2024-09-15T20:38:58Z","modified":"2026-06-28T10:07:53Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-0263","description":"Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.","status":"published","published":"2013-02-08T20:55:00Z","modified":"2025-07-16T06:46:55.142047Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}