Fluid Attacks Database

Description

Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	ruby-rack	>=0 <2.1.1-6	2.1.1-6
rubygems	rack	>=0 <2.1.4 \|\| >=2.2.0 <2.2.3	2.1.4, 2.2.3
debian 12	ruby-rack	>=0 <2.1.1-6	2.1.1-6
debian 13	ruby-rack	>=0 <2.1.1-6	2.1.1-6

Aliases

1. CVE-2020-81842. NVD-2020-81843. OSV-DEBIAN-2020-81844. OSV-2020-81845. GCVE-2020-81846. SECURITY-TRACKER-CVE-2020-81847. lists.debian.org8. lists.debian.org

References

1. https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c2. https://hackerone.com/reports/8957273. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8184.yml4. https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak5. https://usn.ubuntu.com/4561-1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.