actionpack and activesupport vulnerable to information leaks (GHSA-fg9w-g6m4-557j)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2009-3086
Severity: MODERATE · CWE: CWE-200

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.

Affected packages:
package: ecosystem: RubyGems
name: actionpack
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.2.3
package: ecosystem: RubyGems
name: actionpack
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.4
package: ecosystem: RubyGems
name: activesupport
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.2.3
package: ecosystem: RubyGems
name: activesupport
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.4