Missing support for integrity check in Rack - CVE-2020-8184

Vulnerability identifier: #VU67621

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8184

CWE-ID: CWE-353

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing integrity check of secure cookies. A remote attacker can alter the cookies in the requests and bypass implemented security restrictions.

Rack
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Server
openSUSE Leap
Ubuntu
openEuler
ruby-rack (Ubuntu package)
ruby2.5-rubygem-rack-doc
ruby2.5-rubygem-rack-testsuite
ruby2.5-rubygem-rack
rubygem-rack-help
rubygem-rack
php-debugsource
php-pgsql
php-recode
php-opcache
php-mbstring
php-mysqlnd
php-debuginfo
php-odbc
php-embedded
php-dba
php-common
php-bcmath
php-dbg
php-process
php-help
php-xmlrpc
php-ldap
php-xml
php-fpm
php-tidy
php-gd
php-gmp
php-json
php-devel
php-cli
php-pdo
php-enchant
php-soap
php-intl
php-snmp
php
IBM Watson Discovery for IBM Cloud Pak for Data

Install updates from vendor's website.

Rack - addressed in versions 2.1.4, 2.2.3
ruby-rack (Ubuntu package) - addressed in versions 1.6.4-3ubuntu0.2, 1.6.4-4ubuntu0.2, 2.0.7-2ubuntu0.1, 2.1.1-5ubuntu0.1
ruby2.5-rubygem-rack-doc - update to 2.0.8-150000.3.9.1
ruby2.5-rubygem-rack-testsuite - update to 2.0.8-150000.3.9.1
ruby2.5-rubygem-rack - update to 2.0.8-150000.3.9.1
rubygem-rack-help - update to 2.2.3.1-1
rubygem-rack - update to 2.2.3.1-1
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
php-debugsource - addressed in versions 7.2.10-12, 7.2.10-13
php-pgsql - addressed in versions 7.2.10-12, 7.2.10-13
php-recode - addressed in versions 7.2.10-12, 7.2.10-13
php-opcache - addressed in versions 7.2.10-12, 7.2.10-13
php-mbstring - addressed in versions 7.2.10-12, 7.2.10-13
php-mysqlnd - addressed in versions 7.2.10-12, 7.2.10-13
php-debuginfo - addressed in versions 7.2.10-12, 7.2.10-13
php-odbc - addressed in versions 7.2.10-12, 7.2.10-13
php-embedded - addressed in versions 7.2.10-12, 7.2.10-13
php-dba - addressed in versions 7.2.10-12, 7.2.10-13
php-common - addressed in versions 7.2.10-12, 7.2.10-13
php-bcmath - addressed in versions 7.2.10-12, 7.2.10-13
php-dbg - addressed in versions 7.2.10-12, 7.2.10-13
php-process - addressed in versions 7.2.10-12, 7.2.10-13
php-help - addressed in versions 7.2.10-12, 7.2.10-13
php-xmlrpc - addressed in versions 7.2.10-12, 7.2.10-13
php-ldap - addressed in versions 7.2.10-12, 7.2.10-13
php-xml - addressed in versions 7.2.10-12, 7.2.10-13
php-fpm - addressed in versions 7.2.10-12, 7.2.10-13
php-tidy - addressed in versions 7.2.10-12, 7.2.10-13
php-gd - addressed in versions 7.2.10-12, 7.2.10-13
php-gmp - addressed in versions 7.2.10-12, 7.2.10-13
php-json - addressed in versions 7.2.10-12, 7.2.10-13
php-devel - addressed in versions 7.2.10-12, 7.2.10-13
php-cli - addressed in versions 7.2.10-12, 7.2.10-13
php-pdo - addressed in versions 7.2.10-12, 7.2.10-13
php-enchant - addressed in versions 7.2.10-12, 7.2.10-13
php-soap - addressed in versions 7.2.10-12, 7.2.10-13
php-intl - addressed in versions 7.2.10-12, 7.2.10-13
php-snmp - addressed in versions 7.2.10-12, 7.2.10-13
php - addressed in versions 7.2.10-12, 7.2.10-13

• https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak
• https://hackerone.com/reports/895727
• https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
• https://usn.ubuntu.com/4561-1/

• Multiple vulnerabilities in Rubygem Rack
• SUSE update for rubygem-rack
• Ubuntu update for ruby-rack
• openEuler 20.03 LTS SP1 update for php
• openEuler 20.03 LTS update for php
• openEuler update for rubygem-rack
• Multiple vulnerabilities in IBM Watson Discovery
• Ubuntu update for ruby-rack