DEBIAN-CVE-2013-0263

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2013-0263
Downstream
DSA-2783-1
Published: 08 Feb 2013, 20:55
Last modified:28 Apr 2026, 20:12

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Feb 2013, 20:55
Published
Vulnerability first disclosed
28 Apr 2026, 20:12
Last Modified
Vulnerability information updated

Description

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

Affected Systems

  • debian•ruby-rack

    < 1.4.1-2.1 | < 1.4.1-2.1 | < 1.4.1-2.1 | < 1.4.1-2.1

References (1)