CVE-2013-0263
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
- EPSS
- 5.4% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rack_project:rack
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xc85-32mf-xpv8 | RubyGems | rack | >=1.5.0 <1.5.2 | 1.5.2 |
| GHSA-xc85-32mf-xpv8 | RubyGems | rack | >=1.4.0 <1.4.5 | 1.4.5 |
| GHSA-xc85-32mf-xpv8 | RubyGems | rack | >=1.3.0 <1.3.10 | 1.3.10 |
| GHSA-xc85-32mf-xpv8 | RubyGems | rack | >=1.2.0 <1.2.8 | 1.2.8 |
| GHSA-xc85-32mf-xpv8 | RubyGems | rack | >=1.1.0 <1.1.6 | 1.1.6 |