CVE-2012-2671

The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
VendorProductVersion
rtomaykorack-cach
0.3.0
rtomaykorack-cach
0.4
rtomaykorack-cach
0.5
rtomaykorack-cach
0.5.2
rtomaykorack-cach
0.5.3
rtomaykorack-cach
1.0
rtomaykorack-cach
1.0.1
rtomaykorack-cach
1.0.2
rtomaykorack-cach
1.0.3
rtomaykorack-cach
1.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-rack-cache
sid
1.2-4.1
fixed
trixie
1.2-4.1
fixed
bookworm
1.2-4.1
fixed
bullseye
1.2-4.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-rack-cache
precise
dne
oneiric
dne
natty
dne
lucid
dne
hardy
dne
References
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081812.html
http://www.openwall.com/lists/oss-security/2012/06/06/4
http://www.openwall.com/lists/oss-security/2012/06/06/8
https://bugzilla.novell.com/show_bug.cgi?id=763650
https://bugzilla.redhat.com/show_bug.cgi?id=824520
https://github.com/rtomayko/rack-cache/blob/master/CHANGES
https://github.com/rtomayko/rack-cache/commit/2e3a64d07daac4c757cc57620f2288e865a09b90
https://github.com/rtomayko/rack-cache/pull/52
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081812.html
http://www.openwall.com/lists/oss-security/2012/06/06/4
http://www.openwall.com/lists/oss-security/2012/06/06/8
https://bugzilla.novell.com/show_bug.cgi?id=763650
https://bugzilla.redhat.com/show_bug.cgi?id=824520
https://github.com/rtomayko/rack-cache/blob/master/CHANGES
https://github.com/rtomayko/rack-cache/commit/2e3a64d07daac4c757cc57620f2288e865a09b90
https://github.com/rtomayko/rack-cache/pull/52